@lunora/advisor 1.0.0-alpha.21 → 1.0.0-alpha.211

package/dist/index.mjs

@@ -1,181 +1 @@
-import constraintValidator from './packem_shared/constraintValidator-Dr9Py3FD.mjs';
-import hotShard from './packem_shared/hotShard-Ir5D0B6J.mjs';
-import indexUtilization from './packem_shared/indexUtilization-B5DMQ3bI.mjs';
-import actionFetchSsrf from './packem_shared/actionFetchSsrf-wbmYgzmz.mjs';
-import adminRouteWithoutGuard from './packem_shared/adminRouteWithoutGuard-UUGBkAjU.mjs';
-import aiRawRunEscapeHatch from './packem_shared/aiRawRunEscapeHatch-C29jd32J.mjs';
-import aiToolSideEffectPromptInjection from './packem_shared/aiToolSideEffectPromptInjection-BtD3alqB.mjs';
-import aiUnboundedGenerationPublic from './packem_shared/aiUnboundedGenerationPublic-CbAcSxLB.mjs';
-import allowUnauthenticatedShardAccessEnabled from './packem_shared/allowUnauthenticatedShardAccessEnabled-BcASq-jP.mjs';
-import authApiCallWithoutHeaders from './packem_shared/authApiCallWithoutHeaders-BeJhCZaf.mjs';
-import authCsrfCheckDisabled from './packem_shared/authCsrfCheckDisabled-DCf9FSoD.mjs';
-import authEmailVerificationDisabled from './packem_shared/authEmailVerificationDisabled-Dk-Tc5oU.mjs';
-import authSecureCookiesDisabled from './packem_shared/authSecureCookiesDisabled-osJrHW9Y.mjs';
-import authSessionFreshageZero from './packem_shared/authSessionFreshageZero-CjufCc_Q.mjs';
-import authTrustedOriginsWildcard from './packem_shared/authTrustedOriginsWildcard-ylv4PKzC.mjs';
-import browserAllowPrivateTargets from './packem_shared/browserAllowPrivateTargets-CBvQxLAM.mjs';
-import browserUserUrlWithoutAllowlist from './packem_shared/browserUserUrlWithoutAllowlist-CvhA6w59.mjs';
-import circularFk from './packem_shared/circularFk-B2freHrP.mjs';
-import containerInstanceKeyFromUserInput from './packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs';
-import containerOversizedInstance from './packem_shared/containerOversizedInstance-5U1VKPRM.mjs';
-import containerPublicInternet from './packem_shared/containerPublicInternet-CuNerJE5.mjs';
-import containerRuntimeEgressRelaxation from './packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs';
-import containerStartEnableInternetOverride from './packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs';
-import duplicateIndex from './packem_shared/duplicateIndex-BOublMSt.mjs';
-import emptyIndex from './packem_shared/emptyIndex-BX8EuEY7.mjs';
-import filterWithoutIndex from './packem_shared/filterWithoutIndex-BYVeJaSs.mjs';
-import flagGatesSecurityWithUnsafeDefault from './packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs';
-import hardcodedSecret from './packem_shared/hardcodedSecret-W2pz1UZB.mjs';
-import httpActionMissingAuthGuard from './packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs';
-import httpActionResponseHeaderInjection from './packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs';
-import hyperdriveOutsideAction from './packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs';
-import identityUndeclaredClaimTrusted from './packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs';
-import imagesUrlSourceFromUserInput from './packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs';
-import indexReferencesUnknownField from './packem_shared/indexReferencesUnknownField-BSWNngxX.mjs';
-import insertManyUnsafeUserData from './packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs';
-import kvUnscopedUserKeyIdor from './packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs';
-import mailInboundDispatchWithoutVerify from './packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs';
-import mailRecipientFromRequestInput from './packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs';
-import maskUncoveredPiiColumn from './packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs';
-import maskWeakHashStrategyOnPii from './packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs';
-import maskedRelationLeakViaWith from './packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs';
-import mutatorFullRowReplace from './packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs';
-import nondeterministicQueryMutation from './packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs';
-import normalizeIdUsedAsAuthorization from './packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs';
-import outputProjectionMissingOnPublicRead from './packem_shared/outputProjectionMissingOnPublicRead-Bl5IMx0k.mjs';
-import ownerFieldFromArgsNotAuth from './packem_shared/ownerFieldFromArgsNotAuth-mOw3hE5z.mjs';
-import paymentCreateWithoutAuthorize from './packem_shared/paymentCreateWithoutAuthorize-BYm4JLxo.mjs';
-import paymentWebhookWideTolerance from './packem_shared/paymentWebhookWideTolerance-D9QQJMJq.mjs';
-import plaintextSecretInWranglerVariables from './packem_shared/plaintextSecretInWranglerVariables-NKO4YkKf.mjs';
-import policyReferencesUnknownTable from './packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs';
-import privilegedDispatchUnvalidatedPayload from './packem_shared/privilegedDispatchUnvalidatedPayload-5Forjckt.mjs';
-import privilegedFanoutFromPublicProcedure from './packem_shared/privilegedFanoutFromPublicProcedure-D3dL01B8.mjs';
-import publicArgumentUsesAny from './packem_shared/publicArgumentUsesAny-C71b2NCf.mjs';
-import publicMutationWithoutRatelimit from './packem_shared/publicMutationWithoutRatelimit-DbIhgi7j.mjs';
-import publicTableRlsOptoutConfusion from './packem_shared/publicTableRlsOptoutConfusion-Bn71yoD4.mjs';
-import queueWithoutDlq from './packem_shared/queueWithoutDlq-CSkGNb_0.mjs';
-import r2sqlOutsideAction from './packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs';
-import ratelimitDefaultMemoryStore from './packem_shared/ratelimitDefaultMemoryStore-BISChG5C.mjs';
-import ratelimitKeySpoofableOrGlobal from './packem_shared/ratelimitKeySpoofableOrGlobal-DqlHYQQ3.mjs';
-import ratelimitMiddlewareFailOpen from './packem_shared/ratelimitMiddlewareFailOpen-CJgDCaUw.mjs';
-import relationReferencesUnknownField from './packem_shared/relationReferencesUnknownField-CjbLScJ1.mjs';
-import relationReferencesUnknownTable from './packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs';
-import rlsUncoveredTable from './packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs';
-import shapeTargetsGlobalTable from './packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs';
-import shapeUnknownTable from './packem_shared/shapeUnknownTable-C8aDWFoe.mjs';
-import softDeleteIncludeDeletedFromArgs from './packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs';
-import sqlInjectionRisk from './packem_shared/sqlInjectionRisk-zwytYGLt.mjs';
-import storageGenerateUploadUrlNoContentTypePin from './packem_shared/storageGenerateUploadUrlNoContentTypePin-Da4L9Ge8.mjs';
-import storageKeyFromUserArgs from './packem_shared/storageKeyFromUserArgs-B86elJgS.mjs';
-import storagePresignedUrlForPrivateContent from './packem_shared/storagePresignedUrlForPrivateContent-yGmb8uqz.mjs';
-import storageUploadWithoutContentTypeAllowlist from './packem_shared/storageUploadWithoutContentTypeAllowlist-BV-gF1lT.mjs';
-import storageUploadWithoutMaxSize from './packem_shared/storageUploadWithoutMaxSize-DpxO59wU.mjs';
-import tableWithoutInsert from './packem_shared/tableWithoutInsert-CbbaYIP4.mjs';
-import unboundedStringArgument from './packem_shared/unboundedStringArgument-DThg2-wt.mjs';
-import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
-import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
-import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-2DZtWIPb.mjs';
-import vectorsNamespaceFromUserInput from './packem_shared/vectorsNamespaceFromUserInput-CQhr5bVn.mjs';
-import workflowDuplicateStepName from './packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs';
-import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
-import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
-export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-BM14d0lm.mjs';
-export { default as externalSourceOnGlobal } from './packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs';
-export { default as externalSourceUnscoped } from './packem_shared/externalSourceUnscoped-5vT-Bup3.mjs';
-export { fromServerSchema } from './packem_shared/fromServerSchema-BiB6JSiW.mjs';
-
-const STATIC_LINTS = [
-  indexReferencesUnknownField,
-  relationReferencesUnknownTable,
-  relationReferencesUnknownField,
-  workflowUnknownTarget,
-  workflowDuplicateStepName,
-  shapeUnknownTable,
-  emptyIndex,
-  circularFk,
-  unindexedForeignKey,
-  unindexedRelationTarget,
-  duplicateIndex,
-  tableWithoutInsert,
-  workflowUnused,
-  queueWithoutDlq,
-  filterWithoutIndex,
-  shapeTargetsGlobalTable,
-  mutatorFullRowReplace,
-  nondeterministicQueryMutation,
-  hyperdriveOutsideAction,
-  r2sqlOutsideAction,
-  authApiCallWithoutHeaders,
-  policyReferencesUnknownTable,
-  rlsUncoveredTable,
-  maskUncoveredPiiColumn,
-  maskWeakHashStrategyOnPii,
-  containerOversizedInstance,
-  containerPublicInternet,
-  publicMutationWithoutRatelimit,
-  userCreatingMutationWithoutCaptcha,
-  publicArgumentUsesAny,
-  unboundedStringArgument,
-  hardcodedSecret,
-  sqlInjectionRisk,
-  adminRouteWithoutGuard,
-  paymentCreateWithoutAuthorize,
-  mailInboundDispatchWithoutVerify,
-  ratelimitDefaultMemoryStore,
-  browserAllowPrivateTargets,
-  privilegedFanoutFromPublicProcedure,
-  insertManyUnsafeUserData,
-  aiUnboundedGenerationPublic,
-  actionFetchSsrf,
-  ownerFieldFromArgsNotAuth,
-  storageKeyFromUserArgs,
-  kvUnscopedUserKeyIdor,
-  containerInstanceKeyFromUserInput,
-  aiRawRunEscapeHatch,
-  vectorsNamespaceFromUserInput,
-  mailRecipientFromRequestInput,
-  browserUserUrlWithoutAllowlist,
-  privilegedDispatchUnvalidatedPayload,
-  containerStartEnableInternetOverride,
-  containerRuntimeEgressRelaxation,
-  authTrustedOriginsWildcard,
-  authCsrfCheckDisabled,
-  authSecureCookiesDisabled,
-  authEmailVerificationDisabled,
-  authSessionFreshageZero,
-  imagesUrlSourceFromUserInput,
-  ratelimitKeySpoofableOrGlobal,
-  publicTableRlsOptoutConfusion,
-  allowUnauthenticatedShardAccessEnabled,
-  storageUploadWithoutContentTypeAllowlist,
-  storageUploadWithoutMaxSize,
-  storageGenerateUploadUrlNoContentTypePin,
-  storagePresignedUrlForPrivateContent,
-  httpActionMissingAuthGuard,
-  httpActionResponseHeaderInjection,
-  ratelimitMiddlewareFailOpen,
-  flagGatesSecurityWithUnsafeDefault,
-  aiToolSideEffectPromptInjection,
-  identityUndeclaredClaimTrusted,
-  paymentWebhookWideTolerance,
-  softDeleteIncludeDeletedFromArgs,
-  maskedRelationLeakViaWith,
-  outputProjectionMissingOnPublicRead,
-  normalizeIdUsedAsAuthorization,
-  plaintextSecretInWranglerVariables
-];
-const RUNTIME_LINTS = [hotShard, indexUtilization, constraintValidator];
-const ALL_LINTS = [...STATIC_LINTS, ...RUNTIME_LINTS];
-const runAdvisor = (context, options = {}) => {
-  const lints = options.lints ?? ALL_LINTS;
-  const findings = [];
-  for (const lint of lints) {
-    if (options.source !== void 0 && lint.source !== options.source) {
-      continue;
-    }
-    findings.push(...lint.run(context));
-  }
-  return findings;
-};
-
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, actionFetchSsrf, adminRouteWithoutGuard, aiRawRunEscapeHatch, aiToolSideEffectPromptInjection, aiUnboundedGenerationPublic, allowUnauthenticatedShardAccessEnabled, authApiCallWithoutHeaders, authCsrfCheckDisabled, authEmailVerificationDisabled, authSecureCookiesDisabled, authSessionFreshageZero, authTrustedOriginsWildcard, browserAllowPrivateTargets, browserUserUrlWithoutAllowlist, circularFk, constraintValidator, containerInstanceKeyFromUserInput, containerOversizedInstance, containerPublicInternet, containerRuntimeEgressRelaxation, containerStartEnableInternetOverride, duplicateIndex, emptyIndex, filterWithoutIndex, flagGatesSecurityWithUnsafeDefault, hardcodedSecret, hotShard, httpActionMissingAuthGuard, httpActionResponseHeaderInjection, hyperdriveOutsideAction, identityUndeclaredClaimTrusted, imagesUrlSourceFromUserInput, indexReferencesUnknownField, indexUtilization, insertManyUnsafeUserData, kvUnscopedUserKeyIdor, mailInboundDispatchWithoutVerify, mailRecipientFromRequestInput, maskUncoveredPiiColumn, maskWeakHashStrategyOnPii, maskedRelationLeakViaWith, mutatorFullRowReplace, nondeterministicQueryMutation, normalizeIdUsedAsAuthorization, outputProjectionMissingOnPublicRead, ownerFieldFromArgsNotAuth, paymentCreateWithoutAuthorize, paymentWebhookWideTolerance, plaintextSecretInWranglerVariables, policyReferencesUnknownTable, privilegedDispatchUnvalidatedPayload, privilegedFanoutFromPublicProcedure, publicArgumentUsesAny, publicMutationWithoutRatelimit, publicTableRlsOptoutConfusion, queueWithoutDlq, r2sqlOutsideAction, ratelimitDefaultMemoryStore, ratelimitKeySpoofableOrGlobal, ratelimitMiddlewareFailOpen, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, shapeTargetsGlobalTable, shapeUnknownTable, softDeleteIncludeDeletedFromArgs, sqlInjectionRisk, storageGenerateUploadUrlNoContentTypePin, storageKeyFromUserArgs, storagePresignedUrlForPrivateContent, storageUploadWithoutContentTypeAllowlist, storageUploadWithoutMaxSize, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, vectorsNamespaceFromUserInput, workflowDuplicateStepName, workflowUnknownTarget, workflowUnused };
+import{dedupeCacheKeys as c}from"./packem_shared/dedupeCacheKeys-DtBOHffV.mjs";import d from"./packem_shared/fanOutBreadth-CBtmZnoh.mjs";import u from"./packem_shared/hotShard-BwGYZ3Tq.mjs";import h from"./packem_shared/indexUtilization-CkVPZcVe.mjs";import g from"./packem_shared/actionFetchSsrf-BK-kvOPO.mjs";import b from"./packem_shared/actionWithoutErrorHandling-4GCBT0_z.mjs";import y from"./packem_shared/adminRouteWithoutGuard-DPE7LuNh.mjs";import S from"./packem_shared/aiRawRunEscapeHatch-BW7a8kZC.mjs";import w from"./packem_shared/aiRunWithoutLogging-CvHHtEN9.mjs";import v from"./packem_shared/aiToolSideEffectPromptInjection-9eJXRlKt.mjs";import R from"./packem_shared/aiUnboundedGenerationPublic-C17h6sMV.mjs";import A from"./packem_shared/allowUnauthenticatedShardAccessEnabled-BQufF5Kb.mjs";import U from"./packem_shared/authApiCallWithoutHeaders-CReJRsGW.mjs";import W from"./packem_shared/authCsrfCheckDisabled-CRIVsvb9.mjs";import T from"./packem_shared/authEmailVerificationDisabled-BjFlnHr2.mjs";import I from"./packem_shared/authScimWithoutTransactions-B5ATiz5A.mjs";import x from"./packem_shared/authSecureCookiesDisabled-By8PVum3.mjs";import C from"./packem_shared/authSessionFreshageZero-DuxX3Ln9.mjs";import k from"./packem_shared/authTrustedOriginsWildcard-BKIh6788.mjs";import N from"./packem_shared/browserAllowPrivateTargets-Cj5sizhv.mjs";import F from"./packem_shared/browserUserUrlWithoutAllowlist-CzDEraJB.mjs";import M from"./packem_shared/circularFk-DtcWFJxK.mjs";import O from"./packem_shared/commitOrderedHardDelete-BPdwOKA7.mjs";import D from"./packem_shared/containerInstanceKeyFromUserInput-Bl-tAzKV.mjs";import P from"./packem_shared/containerOversizedInstance-Bx89uR7E.mjs";import $ from"./packem_shared/containerPublicInternet-BFfZf_P4.mjs";import E from"./packem_shared/containerRuntimeEgressRelaxation-4tMrhq1k.mjs";import q from"./packem_shared/containerStartEnableInternetOverride-mN_kuRtk.mjs";import K from"./packem_shared/crossModuleTableWrite-DjiVTAwK.mjs";import L from"./packem_shared/dispatchCycle-CWc5Q0cd.mjs";import G from"./packem_shared/duplicateIndex-Cip6-Rpu.mjs";import _ from"./packem_shared/emptyIndex-BnHDcXza.mjs";import z from"./packem_shared/errorWithoutCatalog-BTfvaXHR.mjs";import H from"./packem_shared/exportSinkMisconfigured-JfbAx9AI.mjs";import B from"./packem_shared/externalSourceIncrementalNoDeletePath-BCzm3HzF.mjs";import j from"./packem_shared/externalSourceOnGlobal-CH7xbJ49.mjs";import V from"./packem_shared/externalSourceUnscoped-BxU2uSXk.mjs";import Q from"./packem_shared/filterAfterIndexScan-CV8aPq7v.mjs";import X from"./packem_shared/filterOnPrimaryKey-BeHVg4w3.mjs";import Z from"./packem_shared/filterWithoutIndex-BGv3jbgg.mjs";import J from"./packem_shared/flagGatesSecurityWithUnsafeDefault-B5FBDF8c.mjs";import Y from"./packem_shared/flagReadInSubscription-DabIhYGD.mjs";import oo from"./packem_shared/geoIndexFieldNotGeopoint-BMQuok2-.mjs";import eo from"./packem_shared/geoIndexUnused-D7C9Qr4U.mjs";import ro from"./packem_shared/globalTableNearColumnLimit-BFbBBd6A.mjs";import to from"./packem_shared/hardcodedSecret-Bw_4FYrs.mjs";import io from"./packem_shared/httpActionMissingAuthGuard-DhMIs1EI.mjs";import no from"./packem_shared/httpActionResponseHeaderInjection-mcRYd3Zw.mjs";import ao from"./packem_shared/hyperdriveOutsideAction-CPDdGP2g.mjs";import mo from"./packem_shared/identityUndeclaredClaimTrusted-D1sEd5lr.mjs";import lo from"./packem_shared/imagesUrlSourceFromUserInput-BJXotuyO.mjs";import so from"./packem_shared/indexReferencesUnknownField-DKz4-bla.mjs";import po from"./packem_shared/insertManyUnsafeUserData-DWE8d_DF.mjs";import fo from"./packem_shared/kvUnscopedUserKeyIdor-DhymglIq.mjs";import co from"./packem_shared/mailInboundDispatchWithoutVerify-CWwqXyPX.mjs";import uo from"./packem_shared/mailRecipientFromRequestInput-BVXsZ4Xf.mjs";import ho from"./packem_shared/maskUncoveredPiiColumn-axEka4nd.mjs";import go from"./packem_shared/maskWeakHashStrategyOnPii-DJasagzX.mjs";import bo from"./packem_shared/maskedRelationLeakViaWith-CIFij6vE.mjs";import{e as a}from"./packem_shared/finding-NrKO8idM.mjs";import yo from"./packem_shared/mutatorFullRowReplace-BzRpZ47r.mjs";import So from"./packem_shared/mutatorWithoutOwnerScope-BoS81ns0.mjs";import wo from"./packem_shared/nondeterministicQueryMutation-Bbb-AGOS.mjs";import vo from"./packem_shared/normalizeIdUsedAsAuthorization-BXN-Can6.mjs";import Ro from"./packem_shared/notifyMissingPushConfig-DeQMoNwm.mjs";import Ao from"./packem_shared/notifySendOutsideAction-BJrDkr4h.mjs";import Uo from"./packem_shared/outputProjectionMissingOnPublicRead-DWSeo7oC.mjs";import Wo from"./packem_shared/ownerFieldFromArgsNotAuth-J8Xbz5uI.mjs";import To from"./packem_shared/paymentCreateWithoutAuthorize-CdenWpXD.mjs";import Io from"./packem_shared/paymentWebhookWideTolerance-DVhJB0Ip.mjs";import xo from"./packem_shared/plaintextSecretInWranglerVariables-bNkqmNqV.mjs";import Co from"./packem_shared/policyReferencesUnknownTable-CIKuRZ5Y.mjs";import ko from"./packem_shared/privilegedDispatchUnvalidatedPayload-BM3NtT57.mjs";import No from"./packem_shared/privilegedFanoutFromPublicProcedure-DV188gHQ.mjs";import Fo from"./packem_shared/procedureWithoutStructuredEvent-CZ_B23nM.mjs";import Mo from"./packem_shared/publicArgumentUsesAny-BDEvMA8Q.mjs";import Oo from"./packem_shared/publicMutationWithoutRatelimit-Bd-rRxnz.mjs";import Do from"./packem_shared/publicTableRlsOptoutConfusion-CbNk75Xo.mjs";import Po from"./packem_shared/queueWithoutDlq-BvHz3Opg.mjs";import $o from"./packem_shared/r2sqlOutsideAction-BdLiLOAX.mjs";import Eo from"./packem_shared/ratelimitDefaultMemoryStore-Dj0Kk7t9.mjs";import qo from"./packem_shared/ratelimitKeySpoofableOrGlobal-DHMl74hR.mjs";import Ko from"./packem_shared/ratelimitMiddlewareFailOpen-Di2t8pDc.mjs";import Lo from"./packem_shared/relationReferencesUnknownField-Cl6mik8w.mjs";import Go from"./packem_shared/relationReferencesUnknownTable-vYjirSxf.mjs";import _o from"./packem_shared/rlsUncoveredTable-CZ4ie4gX.mjs";import zo from"./packem_shared/selfRescheduleWithoutProgress-Be9d1bQ0.mjs";import Ho from"./packem_shared/shapeTargetsGlobalTable-Bu3eEDic.mjs";import Bo from"./packem_shared/shapeUnknownTable-CREfNnWi.mjs";import jo from"./packem_shared/signupMutationWithoutDisposableGating-BdKwtxDP.mjs";import Vo from"./packem_shared/softDeleteIncludeDeletedFromArgs-C7Ugg4zb.mjs";import Qo from"./packem_shared/sqlInjectionRisk-BYRllgPV.mjs";import Xo from"./packem_shared/storageGenerateUploadUrlNoContentTypePin-CrwFuo83.mjs";import Zo from"./packem_shared/storageKeyFromUserArgs-3vkxmI3v.mjs";import Jo from"./packem_shared/storagePresignedUrlForPrivateContent-C3KeV5tV.mjs";import Yo from"./packem_shared/storageUploadWithoutContentTypeAllowlist-BXoK_QWE.mjs";import oe from"./packem_shared/storageUploadWithoutMaxSize-CW7uKvSi.mjs";import ee from"./packem_shared/tableWithoutInsert-ClJp_jDr.mjs";import re from"./packem_shared/throughRelationMissingUniqueIndex-Cg5e3GkS.mjs";import te from"./packem_shared/topicTooManySubscriptions-CiZhFm9r.mjs";import ie from"./packem_shared/ttlFieldNotTimestamp-lnb5nmM6.mjs";import{s as ne,q as ae,c as me}from"./packem_shared/helpers-DdZ_pyR3.mjs";import le from"./packem_shared/unboundedCollectOnOpenRange-DHy2RUL7.mjs";import se from"./packem_shared/unboundedLoop-DxN3_apu.mjs";import pe from"./packem_shared/unboundedStringArgument-jZnCbwB0.mjs";import fe from"./packem_shared/unindexedForeignKey-Dypgn8uH.mjs";import ce from"./packem_shared/unindexedRelationTarget-Dj2_NOCm.mjs";import de from"./packem_shared/unrestrictedWhereBranch-CcIBmHik.mjs";import ue from"./packem_shared/userCreatingMutationWithoutCaptcha-D4TZEpgz.mjs";import he from"./packem_shared/vectorsNamespaceFromUserInput-BWvGjJzp.mjs";import ge from"./packem_shared/workflowDuplicateStepName-B6eAJzwA.mjs";import be from"./packem_shared/workflowUnknownTarget-DEKB5H0g.mjs";import ye from"./packem_shared/workflowUnused-DHwwE-1P.mjs";import{callSiteCallers as Mt,callSiteDescription as Ot,callSiteLabel as Dt,callSiteMetadata as Pt,helperRole as $t,isReachableSite as Et,readCallSiteCallers as qt}from"./packem_shared/callSiteCallers-DArHfQSU.mjs";import{compareToBaseline as Lt,parseAdvisorMap as Gt}from"./packem_shared/compareToBaseline-CUG59IOy.mjs";import{gradeFromScore as zt}from"./packem_shared/gradeFromScore-KSt58rj1.mjs";import{MAP_VERSION as Bt,byCodepoint as jt,scoreAdvisor as Vt}from"./packem_shared/MAP_VERSION-MQ5W2B6n.mjs";import{default as Xt}from"./packem_shared/classifySensitivity-JnjaTGYi.mjs";import{fromServerSchema as Jt}from"./packem_shared/fromServerSchema-KWJd4PLE.mjs";const Se={convex:"migrating/from-convex",firebase:"migrating/from-firebase",supabase:"migrating/from-supabase"},m={categories:["SCHEMA"],description:"A migrated-away platform's SDK is still imported from `lunora/` source. The code compiles and typechecks, so a half-finished port keeps reading from the old platform at runtime and the two stores silently drift apart.",facing:"INTERNAL",level:"WARN",name:"migration_stale_import",remediation:"Replace the call with its Lunora equivalent and drop the dependency. If the import is deliberate — a second data source you still read from — move it out of `lunora/` so it is not mistaken for an unfinished migration.",run:r=>r.staleMigrationImports===void 0?[]:r.staleMigrationImports.map(o=>a(m,{cacheKey:`migration_stale_import:${o.file}:${o.line.toString()}:${o.moduleSpecifier}`,detail:`\`${o.file}\` (line ${o.line.toString()}) still imports \`${o.moduleSpecifier}\`. Finish the port — see \`${Se[o.platform]}\` — or move the import out of \`lunora/\` if you genuinely still read from ${o.platform}.`,metadata:{file:o.file,line:o.line,moduleSpecifier:o.moduleSpecifier,platform:o.platform}})),source:"static",title:"Stale migration import"},we=new Map([["global",{level:"WARN",scope:r=>`it reads the whole D1 table "${r}" over a cross-region round trip`}],["root",{level:"WARN",scope:r=>`it loads every row of "${r}" from the root Durable Object's SQLite into memory`}],["shardBy",{level:"INFO",scope:r=>`"${r}" is \`.shardBy()\`, so this collects one shard's rows rather than the whole table — bounded by a single tenant's row count`}]]),ve={level:"WARN",scope:r=>`it loads every row of "${r}"`},l={categories:["PERFORMANCE"],description:"A query calls `.collect()` with no `.withIndex()` and no `.filter()`, so it materializes every row of the table. Any live subscription over it also re-sends that whole result to every subscribed client on every write to the table.",facing:"EXTERNAL",level:"WARN",name:"unbounded_collect",remediation:'Narrow the read with `.withIndex("name", (q) => q.eq(...))`, cap it with `.take(n)`, or page it with `.paginate(args.paginationOpts)` so neither the scan nor the subscription payload grows with the table.',run:r=>{const o=[],i=ne(r.schema);for(const e of r.queries??[]){if(e.terminal!=="collect"||e.hasIndex||e.table===""||e.hasFilter)continue;const t=i.get(e.table),{level:n,scope:s}=we.get(t??"")??ve,p=ae(e),f=n==="WARN"?` A live subscription over this query records a whole-table dependency, so every write to "${e.table}" re-runs it and re-sends the full result to each subscribed socket.`:" Cap it with `.take(n)` if that count can grow.";o.push(a(l,{cacheKey:`unbounded_collect:${e.file}:${e.line.toString()}:${e.table}`,detail:`Query on "${e.table}" at ${p} calls .collect() with no index and no filter — ${s(e.table)}.${f}`,level:n,metadata:{...me(e),shardKind:t??"unknown",table:e.table}}))}return o},source:"static",title:"Unbounded collect"},Re=[so,Go,Lo,be,ge,Bo,B,j,V,_,ro,z,oo,eo,H,ie,O,M,K,fe,ce,re,G,ee,ye,Po,te,X,Z,Q,l,le,se,L,zo,Ho,yo,So,wo,ao,$o,U,Co,_o,ho,go,P,$,Oo,de,ue,jo,Mo,pe,to,Qo,y,To,co,Eo,N,No,Fo,po,R,g,b,Wo,Zo,fo,D,S,w,he,uo,F,ko,q,E,I,k,W,x,T,C,lo,qo,Do,A,Yo,oe,Xo,Jo,io,no,Ko,J,Y,v,mo,Io,Vo,bo,Uo,vo,Ao,Ro,xo,m],Ae=[u,h,d],Ue=[...Re,...Ae],kt=(r,o={})=>{const i=o.lints??Ue,e=[];for(const t of i)o.source!==void 0&&t.source!==o.source||e.push(...t.run(r));return c(e)};export{Ue as ALL_LINTS,Bt as MAP_VERSION,Ae as RUNTIME_LINTS,Re as STATIC_LINTS,g as actionFetchSsrf,b as actionWithoutErrorHandling,y as adminRouteWithoutGuard,S as aiRawRunEscapeHatch,w as aiRunWithoutLogging,v as aiToolSideEffectPromptInjection,R as aiUnboundedGenerationPublic,A as allowUnauthenticatedShardAccessEnabled,U as authApiCallWithoutHeaders,W as authCsrfCheckDisabled,T as authEmailVerificationDisabled,I as authScimWithoutTransactions,x as authSecureCookiesDisabled,C as authSessionFreshageZero,k as authTrustedOriginsWildcard,N as browserAllowPrivateTargets,F as browserUserUrlWithoutAllowlist,jt as byCodepoint,Mt as callSiteCallers,Ot as callSiteDescription,Dt as callSiteLabel,Pt as callSiteMetadata,M as circularFk,Xt as classifySensitivity,O as commitOrderedHardDelete,Lt as compareToBaseline,D as containerInstanceKeyFromUserInput,P as containerOversizedInstance,$ as containerPublicInternet,E as containerRuntimeEgressRelaxation,q as containerStartEnableInternetOverride,K as crossModuleTableWrite,c as dedupeCacheKeys,L as dispatchCycle,G as duplicateIndex,_ as emptyIndex,z as errorWithoutCatalog,H as exportSinkMisconfigured,B as externalSourceIncrementalNoDeletePath,j as externalSourceOnGlobal,V as externalSourceUnscoped,d as fanOutBreadth,Q as filterAfterIndexScan,X as filterOnPrimaryKey,Z as filterWithoutIndex,J as flagGatesSecurityWithUnsafeDefault,Y as flagReadInSubscription,Jt as fromServerSchema,oo as geoIndexFieldNotGeopoint,eo as geoIndexUnused,ro as globalTableNearColumnLimit,zt as gradeFromScore,to as hardcodedSecret,$t as helperRole,u as hotShard,io as httpActionMissingAuthGuard,no as httpActionResponseHeaderInjection,ao as hyperdriveOutsideAction,mo as identityUndeclaredClaimTrusted,lo as imagesUrlSourceFromUserInput,so as indexReferencesUnknownField,h as indexUtilization,po as insertManyUnsafeUserData,Et as isReachableSite,fo as kvUnscopedUserKeyIdor,co as mailInboundDispatchWithoutVerify,uo as mailRecipientFromRequestInput,ho as maskUncoveredPiiColumn,go as maskWeakHashStrategyOnPii,bo as maskedRelationLeakViaWith,yo as mutatorFullRowReplace,So as mutatorWithoutOwnerScope,wo as nondeterministicQueryMutation,vo as normalizeIdUsedAsAuthorization,Ro as notifyMissingPushConfig,Ao as notifySendOutsideAction,Uo as outputProjectionMissingOnPublicRead,Wo as ownerFieldFromArgsNotAuth,Gt as parseAdvisorMap,To as paymentCreateWithoutAuthorize,Io as paymentWebhookWideTolerance,xo as plaintextSecretInWranglerVariables,Co as policyReferencesUnknownTable,ko as privilegedDispatchUnvalidatedPayload,No as privilegedFanoutFromPublicProcedure,Fo as procedureWithoutStructuredEvent,Mo as publicArgumentUsesAny,Oo as publicMutationWithoutRatelimit,Do as publicTableRlsOptoutConfusion,Po as queueWithoutDlq,$o as r2sqlOutsideAction,Eo as ratelimitDefaultMemoryStore,qo as ratelimitKeySpoofableOrGlobal,Ko as ratelimitMiddlewareFailOpen,qt as readCallSiteCallers,Lo as relationReferencesUnknownField,Go as relationReferencesUnknownTable,_o as rlsUncoveredTable,kt as runAdvisor,Vt as scoreAdvisor,zo as selfRescheduleWithoutProgress,Ho as shapeTargetsGlobalTable,Bo as shapeUnknownTable,jo as signupMutationWithoutDisposableGating,Vo as softDeleteIncludeDeletedFromArgs,Qo as sqlInjectionRisk,Xo as storageGenerateUploadUrlNoContentTypePin,Zo as storageKeyFromUserArgs,Jo as storagePresignedUrlForPrivateContent,Yo as storageUploadWithoutContentTypeAllowlist,oe as storageUploadWithoutMaxSize,ee as tableWithoutInsert,re as throughRelationMissingUniqueIndex,te as topicTooManySubscriptions,ie as ttlFieldNotTimestamp,le as unboundedCollectOnOpenRange,se as unboundedLoop,pe as unboundedStringArgument,fe as unindexedForeignKey,ce as unindexedRelationTarget,de as unrestrictedWhereBranch,ue as userCreatingMutationWithoutCaptcha,he as vectorsNamespaceFromUserInput,ge as workflowDuplicateStepName,be as workflowUnknownTarget,ye as workflowUnused};

package/dist/packem_shared/MAP_VERSION-MQ5W2B6n.mjs

@@ -0,0 +1 @@
+import{readCallSiteCallers as y}from"./callSiteCallers-DArHfQSU.mjs";import{scoreProcedure as v,procedureWeight as S,coverageFromScore as b,scoreGlobal as k,projectWeight as M,gradeFromScore as j,weightFor as N,worstLevel as C}from"./gradeFromScore-KSt58rj1.mjs";import F from"./classifySensitivity-JnjaTGYi.mjs";const x=(e,r)=>e===r?0:e<r?-1:1,w=(e,r)=>x(e.name,r.name),P=(e,r)=>{const o=e[r];return typeof o=="string"?o:void 0},f=(e,r)=>`${e}#${r}`,A=(e,r,o,c)=>e===void 0?{level:r,name:o,occurrences:1,weight:c}:{level:C(e.level,r),name:o,occurrences:e.occurrences+1,weight:Math.max(e.weight,c)},I=(e,r)=>{const o=new Map;for(const t of e)o.set(f(t.file,t.exportName),new Map);const c=new Map;for(const t of r){const s=P(t.metadata,"file"),l=y(t.metadata),m=s===void 0?[]:l.flatMap(a=>o.get(f(s,a))??[]),d=m.length===0?[c]:m;for(const a of d)a.set(t.name,A(a.get(t.name),t.level,t.name,N(t.level)))}return{byProcedure:new Map([...o].map(([t,s])=>[t,[...s.values()].toSorted(w)])),project:[...c.values()].toSorted(w)}},R=(e,r)=>{const o={clean:0,exempt:0,failing:0,warned:0};let c=r.checks.length;for(const t of e)o[t.coverage]+=1,c+=t.checks.length;return{clean:o.clean,exempt:o.exempt,failing:o.failing,procedures:e.length,rulesFired:c,warned:o.warned}},W=1,B=(e,r,o={})=>{const c=new Set(o.exempt),t=I(e,r),s=e.map(n=>{const i=f(n.file,n.exportName),p=t.byProcedure.get(i)??[],u=v(p),g=c.has(i)||n.exempt===!0,h=F(n);return{checks:p,coverage:g?"exempt":b(u),...g?{exemptReason:n.exemptReason??""}:{},exportName:n.exportName,file:n.file,id:i,kind:n.kind,score:u,sensitivity:h,visibility:n.visibility,weight:g?0:S(n,h.level)}}).toSorted((n,i)=>x(n.id,i.id)),l={checks:t.project,score:v(t.project)},m=s.filter(n=>n.coverage!=="exempt"),d=m.reduce((n,i)=>n+i.weight,0),a=k([...m,{score:l.score,weight:M(d)}]);return{generatedAt:o.generatedAt??new Date().toISOString(),grade:j(a),procedures:s,project:l,score:a,summary:R(s,l),version:W}};export{W as MAP_VERSION,x as byCodepoint,B as scoreAdvisor};

package/dist/packem_shared/actionFetchSsrf-BK-kvOPO.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";import{c as r,a as s}from"./helpers-DdZ_pyR3.mjs";const i={categories:["SECURITY"],description:"An action's `ctx.fetch(url)` fetches a URL derived from the handler's `args`. `ctx.fetch` applies no host allowlist, so request-controlled URLs let a caller reach cloud metadata endpoints or internal services — server-side request forgery.",facing:"EXTERNAL",level:"ERROR",name:"action_fetch_ssrf",remediation:"Validate the URL against an allowlist of expected hosts before fetching, and reject private, loopback, and link-local addresses (notably `169.254.169.254`). Never pass request input straight to `ctx.fetch`.",run:t=>t.argumentDerivedFetches===void 0?[]:t.argumentDerivedFetches.map(e=>a(i,{cacheKey:`action_fetch_ssrf:${e.file}:${e.line.toString()}`,detail:`\`ctx.fetch\` in ${s(e)} fetches a URL derived from \`args\` — a server-side request forgery vector. Validate the URL against a host allowlist and reject private/link-local targets before fetching.`,metadata:{...r(e)}})),source:"static",title:"Possible SSRF from arg-derived ctx.fetch URL"};export{i as default};

package/dist/packem_shared/actionWithoutErrorHandling-4GCBT0_z.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";const n={categories:["SCHEMA"],description:"An `action` calls an outbound surface (fetch, mail, queues, storage, sql, ai) with no `try`/`catch`. Those fail routinely, and an uncaught rejection reaches the caller with no indication of which dependency broke.",facing:"EXTERNAL",level:"WARN",name:"action_without_error_handling",remediation:"Wrap the outbound call in `try`/`catch`, then either degrade or rethrow a coded `LunoraError` naming the dependency that failed.",run:t=>t.procedureProtections===void 0?[]:t.procedureProtections.filter(e=>e.kind==="action"&&e.reachesOutbound===!0&&e.handlesErrors===!1).map(e=>a(n,{cacheKey:`action_without_error_handling:${e.file}:${e.exportName}`,detail:`Action \`${e.exportName}\` (${e.file}) calls an outbound surface with no \`try\`/\`catch\`. A dependency failure will surface to the caller unexplained.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind}})),source:"static",title:"Action performs outbound I/O with no error handling"};export{n as default};

package/dist/packem_shared/adminRouteWithoutGuard-DPE7LuNh.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";const i={categories:["SECURITY"],description:"An `httpRoute` on an admin/privileged path has no visible auth/admin guard. REST routes aren't covered by RLS, so an unguarded `/admin/*` route is callable by anyone who reaches the URL.",facing:"EXTERNAL",level:"WARN",name:"admin_route_without_guard",remediation:"Assert an authenticated, authorized caller at the top of the handler — check `ctx.auth` / `getSession(...)`, or a `requireAdmin`-style guard — and reject (401/403) before doing privileged work. For machine callers, verify a secret with a timing-safe compare.",run:a=>a.adminRoutes===void 0?[]:a.adminRoutes.filter(e=>!e.usesGuard).map(e=>t(i,{cacheKey:`admin_route_without_guard:${e.file}:${e.method}:${e.path}`,detail:`Route \`${e.method} ${e.path}\` (\`${e.exportName}\` in ${e.file}) is on an admin/privileged path but its handler shows no auth/admin guard. Assert an authorized caller before doing privileged work.`,metadata:{exportName:e.exportName,file:e.file,method:e.method,path:e.path}})),source:"static",title:"Admin route without an auth guard"};export{i as default};

package/dist/packem_shared/aiRawRunEscapeHatch-BW7a8kZC.mjs

@@ -0,0 +1 @@
+import{e as r}from"./finding-NrKO8idM.mjs";import{c as t,a as i}from"./helpers-DdZ_pyR3.mjs";const s={categories:["SECURITY"],description:"A `ctx.ai.run(model, …)` call selects its model from the handler's `args` with no server-side scoping. `ctx.ai.run` is the raw Workers AI binding passthrough, so an arg-derived model id lets any caller pick an arbitrary model — bypassing the typed `ctx.ai.model(...)` + AI-SDK layer's cap/schema.",facing:"EXTERNAL",level:"WARN",name:"ai_raw_run_escape_hatch",remediation:"Select the model from a fixed server-side allowlist — never from `args`. Prefer the typed `ctx.ai.model(...)` + `generateText`/`streamText` path with an output cap over the raw `ctx.ai.run` escape hatch.",run:a=>a.aiRawRuns===void 0?[]:a.aiRawRuns.map(e=>r(s,{cacheKey:`ai_raw_run_escape_hatch:${e.file}:${e.line.toString()}`,detail:`\`ctx.ai.run\` in ${i(e)} selects its model from \`args\` with no server-side scoping — any caller can pick an arbitrary model, bypassing the typed AI-SDK layer's cap/schema. Select the model from a fixed server-side allowlist instead.`,metadata:{...t(e)}})),source:"static",title:"Possible arbitrary model selection from arg-derived ctx.ai.run"};export{s as default};

package/dist/packem_shared/aiRunWithoutLogging-CvHHtEN9.mjs

@@ -0,0 +1 @@
+import{e as n}from"./finding-NrKO8idM.mjs";const i={categories:["PERFORMANCE"],description:"A procedure runs an AI generation but emits no structured event. Model calls bill per invocation and are not reproducible, so without one there is no way to attribute spend or trace a bad answer back to its prompt.",facing:"INTERNAL",level:"INFO",name:"ai_run_without_logging",remediation:'Emit an event around the generation — `ctx.span("<name>", …)`, or a `ctx.log` line carrying the model and token usage.',run:e=>e.procedureProtections===void 0?[]:e.procedureProtections.filter(t=>t.runsAiGeneration===!0&&t.emitsEvent===!1).map(t=>n(i,{cacheKey:`ai_run_without_logging:${t.file}:${t.exportName}`,detail:`${t.kind} \`${t.exportName}\` (${t.file}) runs an AI generation with no structured event, so its cost and output cannot be attributed later.`,metadata:{exportName:t.exportName,file:t.file,kind:t.kind}})),source:"static",title:"AI generation with no structured event"};export{i as default};

package/dist/packem_shared/aiToolSideEffectPromptInjection-9eJXRlKt.mjs

@@ -0,0 +1 @@
+import{e as o}from"./finding-NrKO8idM.mjs";import{a as n,c as a}from"./helpers-DdZ_pyR3.mjs";const r={categories:["SECURITY"],description:"A `generateText` / `streamText` call whose prompt/messages carry user-supplied text and whose model-callable `tools` perform a privileged side effect (DB write, `ctx.run` dispatch, or outbound send). An injected instruction in the user text can steer the model into firing that action — the confused-deputy prompt-injection hazard.",facing:"EXTERNAL",level:"WARN",name:"ai_tool_side_effect_prompt_injection",remediation:"Don't let a model with user-derived input directly trigger a privileged action. Have the tool return a proposal the server validates and authorizes before executing, gate the side effect behind an explicit human/step confirmation, or keep side-effecting tools out of any generation whose prompt includes untrusted input.",run:t=>t.aiToolSideEffects===void 0?[]:t.aiToolSideEffects.filter(e=>e.userInputDerived).map(e=>{const i=n(e);return o(r,{cacheKey:`ai_tool_side_effect_prompt_injection:${e.file}:${e.line.toString()}`,detail:`\`${e.method}\` in ${i} feeds user-derived input to a model whose tools reach \`${e.sideEffect}\`. An injected instruction can steer the model into firing that side effect.`,metadata:{...a(e),method:e.method,sideEffect:e.sideEffect}})}),source:"static",title:"AI tool side effect reachable via prompt injection"};export{r as default};

package/dist/packem_shared/aiUnboundedGenerationPublic-C17h6sMV.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";import{m as i}from"./procedure-protections-DRQotu9I.mjs";const a={categories:["SECURITY"],description:"A public procedure runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound. Generation bills per output token, so an anonymous caller can request arbitrarily long completions in a loop — a denial-of-wallet vector that also ties up worker time on long streams.",facing:"EXTERNAL",level:"WARN",name:"ai_unbounded_generation_public",remediation:"Cap the completion with `maxOutputTokens` in the generation config, and rate-limit the public entry point (`.use(rateLimit(...))`). For expensive models, prefer running generation from an internal, authenticated path rather than exposing it directly to anonymous callers.",run:n=>n.procedureProtections===void 0?[]:n.procedureProtections.filter(e=>i(e.unboundedAiGeneration)&&e.visibility==="public").map(e=>t(a,{cacheKey:`ai_unbounded_generation_public:${e.file}:${e.exportName}`,detail:`\`${e.exportName}\` (${e.file}) is public and runs an AI generation with no \`maxOutputTokens\` bound — an anonymous caller can drive unbounded, billable completions in a loop. Add a \`maxOutputTokens\` cap and rate-limit the entry point.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind}})),source:"static",title:"Public procedure runs unbounded AI generation (no maxOutputTokens)"};export{a as default};

package/dist/packem_shared/allowUnauthenticatedShardAccessEnabled-BQufF5Kb.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";const n=new Set(["extend","lunora"]),s={categories:["SECURITY"],description:"`allowUnauthenticatedShardAccess: true` — set on the `lunora()` Vite plugin, or through `.extend(() => ({ … }))` — disables the fail-closed default that denies an unauthenticated shard lookup. Combined with a schema that doesn't enforce `.rls(\"required\")` everywhere (or that leaves a table `.public()`), an unauthenticated caller can shard-hop into another tenant's rows with no row-security guard behind the door.",facing:"EXTERNAL",level:"WARN",name:"allow_unauthenticated_shard_access_enabled",remediation:"Prefer `authorizeShard` / `authorizeFanOut` (which take precedence over `allowUnauthenticatedShardAccess` and let you allow specific unauthenticated cases) over the blanket opt-out. If the app genuinely needs open shard access, enforce `.rls(\"required\")` on the schema with no `.public()` tables so a missing identity still can't read another tenant's rows.",run:a=>a.configCalls===void 0?[]:a.schema.rlsMode!=="required"||a.schema.tables.some(e=>e.isPublic)?a.configCalls.filter(e=>n.has(e.callee)&&e.trueKeys.includes("allowUnauthenticatedShardAccess")).map(e=>t(s,{cacheKey:`allow_unauthenticated_shard_access_enabled:${e.file}:${e.line.toString()}`,detail:`\`${e.callee==="lunora"?"lunora(...)":".extend(...)"}\` in ${e.file}:${e.line.toString()} sets \`allowUnauthenticatedShardAccess: true\`, and the schema has an RLS gap (no \`.rls("required")\`, or a \`.public()\` table) — an unauthenticated caller can shard-hop into another tenant's rows with no row-security guard behind the door.`,metadata:{callee:e.callee,file:e.file,line:e.line}})):[],source:"static",title:"Unauthenticated shard access enabled on an RLS-gapped schema"};export{s as default};

package/dist/packem_shared/argument-derived-sink-DLXFC79t.mjs

@@ -0,0 +1 @@
+import{e as i}from"./finding-NrKO8idM.mjs";const d=e=>{const a={categories:e.categories,description:e.description,facing:e.facing,level:e.level,name:e.name,remediation:e.remediation,run:r=>{const s=e.getAccesses(r);return s===void 0||e.suppressWhen?.(r)===!0?[]:s.map(t=>i(a,{cacheKey:e.cacheKey(t),detail:e.detail(t),metadata:e.metadata(t)}))},source:"static",title:e.title};return a};export{d as m};

package/dist/packem_shared/authApiCallWithoutHeaders-CReJRsGW.mjs

@@ -0,0 +1 @@
+import{dedupeCacheKeys as i}from"./dedupeCacheKeys-DtBOHffV.mjs";import{e as a}from"./finding-NrKO8idM.mjs";import{c as s,a as r}from"./helpers-DdZ_pyR3.mjs";const h={categories:["SECURITY"],description:"A `ctx.authApi.<method>(...)` call omits `headers` — better-auth skips session authorization and runs the call with full server-to-server privileges, regardless of the caller's identity.",facing:"EXTERNAL",level:"WARN",name:"auth_api_call_without_headers",remediation:"Pass the inbound `headers` from the incoming request into every `ctx.authApi.*` call: `ctx.authApi.<method>({ body, headers: request.headers })`. See the `withAuthPlugins` middleware doc for details.",run:t=>t.authApiCalls===void 0?[]:i(t.authApiCalls.filter(e=>!e.hasHeaders).map(e=>a(h,{cacheKey:`auth_api_call_without_headers:${e.file}:${e.line.toString()}:${e.method}`,detail:`\`ctx.authApi.${e.method||"<method>"}(…)\` in ${r(e)} is called without \`headers\` — better-auth skips session authorization, so this runs with full privileges. Pass the inbound \`headers\`.`,metadata:{...s(e),method:e.method}}))),source:"static",title:"Privileged ctx.authApi call missing headers"};export{h as default};

package/dist/packem_shared/authCsrfCheckDisabled-CRIVsvb9.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";import{c as i,a as r}from"./helpers-DdZ_pyR3.mjs";const s={categories:["SECURITY"],description:"A `createAuth({...})` call sets `advanced.disableCSRFCheck: true`, turning off better-auth's origin validation for state-changing auth requests — a cross-site request riding the ambient auth cookie is processed like a same-origin one.",facing:"EXTERNAL",level:"ERROR",name:"auth_csrf_check_disabled",remediation:"Remove `advanced.disableCSRFCheck: true` from `createAuth({...})` and rely on `trustedOrigins` for origin validation instead of disabling the check.",run:a=>a.authConfigs===void 0?[]:a.authConfigs.filter(e=>e.analyzable&&e.disableCsrfCheck).map(e=>t(s,{cacheKey:`auth_csrf_check_disabled:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in ${r(e)} sets \`advanced.disableCSRFCheck: true\`, turning off origin validation for state-changing auth requests. Remove the flag and rely on \`trustedOrigins\` instead.`,metadata:{...i(e)}})),source:"static",title:"createAuth CSRF check disabled"};export{s as default};

package/dist/packem_shared/authEmailVerificationDisabled-BjFlnHr2.mjs

@@ -0,0 +1 @@
+import{e as i}from"./finding-NrKO8idM.mjs";import{c as t,a as r}from"./helpers-DdZ_pyR3.mjs";const l={categories:["SECURITY"],description:"A `createAuth({...})` call enables `emailAndPassword` with no `requireEmailVerification: true`. better-auth defaults email verification off, so an account is usable before the caller has proven ownership of the email address.",facing:"EXTERNAL",level:"WARN",name:"auth_email_verification_disabled",remediation:"Set `emailAndPassword.requireEmailVerification: true` on `createAuth({...})` so a new account can't act until its email address is verified.",run:a=>a.authConfigs===void 0?[]:a.authConfigs.filter(e=>e.analyzable&&e.emailPasswordEnabled&&!e.requireEmailVerification).map(e=>i(l,{cacheKey:`auth_email_verification_disabled:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in ${r(e)} enables \`emailAndPassword\` with no \`requireEmailVerification: true\`, so an account is usable before its email is proven. Set \`emailAndPassword.requireEmailVerification: true\`.`,metadata:{...t(e)}})),source:"static",title:"createAuth email verification disabled"};export{l as default};

package/dist/packem_shared/authScimWithoutTransactions-B5ATiz5A.mjs

@@ -0,0 +1 @@
+import{e}from"./finding-NrKO8idM.mjs";import{c as r,a as s}from"./helpers-DdZ_pyR3.mjs";const i={categories:["SECURITY"],description:"A `createAuth({...})` call loads `scim()` with a `database` that has no native transactions (`lunoraD1Adapter` / `lunoraAuthAdapter`). `@better-auth/scim` refuses to serve on such an adapter, so every SCIM request fails.",facing:"EXTERNAL",level:"ERROR",name:"auth_scim_without_transactions",remediation:"Move the auth tables somewhere with real transactions: `.auth({ namespace })` with a `LunoraAuthDO` (Durable Object storage), or a Postgres/MySQL kysely dialect over `@lunora/hyperdrive` with `transaction: true`. D1 cannot host SCIM.",run:t=>t.authConfigs===void 0?[]:t.authConfigs.filter(a=>a.analyzable&&a.scimOnNonTransactionalAdapter).map(a=>e(i,{cacheKey:`auth_scim_without_transactions:${a.file}:${a.line.toString()}`,detail:`\`createAuth\` in ${s(a)} loads \`scim()\` on an adapter without native transactions, so the SCIM plugin will refuse to serve and every provisioning request from your IdP fails. Host the auth tables in a Durable Object (\`.auth({ namespace })\`) or on Postgres/MySQL via \`@lunora/hyperdrive\`.`,metadata:{...r(a)}})),source:"static",title:"SCIM configured on an adapter without transactions"};export{i as default};

package/dist/packem_shared/authSecureCookiesDisabled-By8PVum3.mjs

@@ -0,0 +1 @@
+import{e as s}from"./finding-NrKO8idM.mjs";import{c as a,a as o}from"./helpers-DdZ_pyR3.mjs";const i={categories:["SECURITY"],description:"A `createAuth({...})` call sets `advanced.useSecureCookies: false`, overriding Lunora's secure-by-default posture — the session cookie ships without `Secure` even on an HTTPS deployment, so it can be sent over a plaintext connection.",facing:"EXTERNAL",level:"ERROR",name:"auth_secure_cookies_disabled",remediation:"Remove `advanced.useSecureCookies: false` from `createAuth({...})` — let Lunora's secure-by-default posture set the `Secure` cookie attribute for an HTTPS deployment.",run:t=>t.authConfigs===void 0?[]:t.authConfigs.filter(e=>e.analyzable&&e.secureCookiesDisabled).map(e=>s(i,{cacheKey:`auth_secure_cookies_disabled:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in ${o(e)} sets \`advanced.useSecureCookies: false\`, so the session cookie ships without \`Secure\` even on an HTTPS deployment. Remove the override and let Lunora's secure-by-default posture apply.`,metadata:{...a(e)}})),source:"static",title:"createAuth secure cookies disabled"};export{i as default};

package/dist/packem_shared/authSessionFreshageZero-DuxX3Ln9.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";import{c as r,a}from"./helpers-DdZ_pyR3.mjs";const i={categories:["SECURITY"],description:"A `createAuth({...})` call sets `session.freshAge: 0`, disabling better-auth's recent-reauth check for sensitive operations — a long-lived stolen session can perform them without proving the caller still controls the credentials.",facing:"EXTERNAL",level:"WARN",name:"auth_session_freshage_zero",remediation:"Remove `session.freshAge: 0` from `createAuth({...})` (or set it to a real window) so sensitive operations require a recently re-authenticated session.",run:s=>s.authConfigs===void 0?[]:s.authConfigs.filter(e=>e.analyzable&&e.sessionFreshAgeZero).map(e=>t(i,{cacheKey:`auth_session_freshage_zero:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in ${a(e)} sets \`session.freshAge: 0\`, disabling the recent-reauth check for sensitive operations. Remove the override or set a real window.`,metadata:{...r(e)}})),source:"static",title:"createAuth session freshAge zero"};export{i as default};

package/dist/packem_shared/authTrustedOriginsWildcard-BKIh6788.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";import{c as r,a}from"./helpers-DdZ_pyR3.mjs";const s={categories:["SECURITY"],description:"A `createAuth({...})` call's `trustedOrigins` array contains a `\"*\"` entry, disabling better-auth's CSRF/origin validation entirely — any origin is accepted for state-changing auth requests.",facing:"EXTERNAL",level:"ERROR",name:"auth_trusted_origins_wildcard",remediation:'List the specific origins your deployment serves in `trustedOrigins` instead of `"*"` — a wildcard disables origin validation for every caller.',run:e=>e.authConfigs===void 0?[]:e.authConfigs.filter(i=>i.analyzable&&i.trustedOriginsWildcard).map(i=>t(s,{cacheKey:`auth_trusted_origins_wildcard:${i.file}:${i.line.toString()}`,detail:`\`createAuth\` in ${a(i)} sets \`trustedOrigins\` to include \`"*"\`, disabling CSRF/origin validation for every request. List the specific origins your deployment serves instead.`,metadata:{...r(i)}})),source:"static",title:"createAuth trustedOrigins wildcard"};export{s as default};

package/dist/packem_shared/browserAllowPrivateTargets-Cj5sizhv.mjs

@@ -0,0 +1 @@
+import{e as r}from"./finding-NrKO8idM.mjs";const a={categories:["SECURITY"],description:"`createBrowser({ allowPrivateTargets: true })` disables the private/internal-IP SSRF guard, letting a navigated URL reach cloud metadata endpoints, internal services, or loopback. Combined with a request-supplied URL this is a server-side request forgery path.",facing:"EXTERNAL",level:"ERROR",name:"browser_allow_private_targets",remediation:"Remove `allowPrivateTargets: true` from `createBrowser({...})` so the private/internal-address guard stays on. If a specific internal host is genuinely required, pin it with an `allowedHosts` allowlist instead of opening all private targets.",run:t=>t.configCalls===void 0?[]:t.configCalls.filter(e=>e.callee==="createBrowser"&&e.trueKeys.includes("allowPrivateTargets")).map(e=>r(a,{cacheKey:`browser_allow_private_targets:${e.file}:${e.line.toString()}`,detail:`\`createBrowser({ allowPrivateTargets: true })\` in ${e.file}:${e.line.toString()} disables the private/internal-address SSRF guard — a navigated URL can then reach cloud metadata, internal services, or loopback. Remove the override, or pin the specific host with \`allowedHosts\` instead.`,metadata:{callee:e.callee,file:e.file,line:e.line}})),source:"static",title:"Browser with private-target SSRF guard disabled"};export{a as default};

package/dist/packem_shared/browserUserUrlWithoutAllowlist-CzDEraJB.mjs

@@ -0,0 +1 @@
+import{m as t}from"./argument-derived-sink-DLXFC79t.mjs";import{c as s,a as o}from"./helpers-DdZ_pyR3.mjs";const n=t({cacheKey:e=>`browser_user_url_without_allowlist:${e.file}:${e.line.toString()}`,categories:["SECURITY"],description:"A `ctx.browser.<method>(url, …)` call navigates to a URL derived from the handler's `args` with no server-side scoping, and no `createBrowser` allowlist contains it. The default guard blocks private targets but not arbitrary public URLs, so any caller can make the headless browser an open-proxy / SSRF tool (fetch arbitrary third-party URLs, DNS-rebind to internal hosts).",detail:e=>`\`ctx.browser.${e.method}\` in ${o(e)} navigates to a URL derived from \`args\` with no server-side scoping, and no \`createBrowser\` allowlist contains it — the default guard blocks private targets but not arbitrary public URLs, so any caller can turn the headless browser into an open-proxy / SSRF tool. Pin \`allowedHosts\` on \`createBrowser({...})\` (Browser Run enforces it on the session), and derive the URL from server-trusted state where possible.`,facing:"EXTERNAL",getAccesses:e=>e.browserUrlAccesses,level:"WARN",metadata:e=>({...s(e),method:e.method}),name:"browser_user_url_without_allowlist",remediation:"Pin the browser with an `allowedHosts` allowlist on `createBrowser({...})` — Browser Run enforces it on the session, which makes it the supported production posture — and derive the navigation URL from server-trusted state where possible rather than passing `args` straight to `ctx.browser`.",suppressWhen:e=>(e.configCalls??[]).some(r=>r.callee==="createBrowser"&&r.analyzable&&r.presentKeys.includes("allowedHosts")),title:"Browser navigates to arg-derived URL with no allowlist"});export{n as default};

package/dist/packem_shared/callSiteCallers-DArHfQSU.mjs

@@ -0,0 +1 @@
+const l=e=>{switch(e.kind){case"export":return[e.name];case"helper":return e.callers;default:return[]}},u=e=>l(e).length>0||e.kind==="helper"&&e.untracked===!0,c=e=>e.kind==="module"?"<module>":e.name,n=e=>{const r=e.callers.map(t=>`\`${t}\``).join(", ");return e.untracked===!0?r===""?"a helper reached only from code outside any export":`a helper called by ${r} and by code outside any export`:r===""?"a non-exported helper no exported function calls":`a helper called by ${r}`},d=e=>{switch(e.kind){case"export":return`\`${e.name}\``;case"helper":return`\`${e.name}\` (${n(e)})`;default:return"module scope"}},i=e=>{switch(e.kind){case"export":return{exportName:e.name};case"helper":return{callers:e.callers,helper:e.name,...e.untracked===!0?{untracked:!0}:{}};default:return{}}},o=e=>{const{callers:r,exportName:t}=e;return typeof t=="string"?[t]:Array.isArray(r)?r.filter(a=>typeof a=="string"):[]};export{l as callSiteCallers,d as callSiteDescription,c as callSiteLabel,i as callSiteMetadata,n as helperRole,u as isReachableSite,o as readCallSiteCallers};

package/dist/packem_shared/circularFk-DtcWFJxK.mjs

@@ -0,0 +1 @@
+import{e as w}from"./finding-NrKO8idM.mjs";const E=100,S={categories:["SCHEMA"],description:"A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",facing:"INTERNAL",level:"WARN",name:"circular_fk",remediation:"Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",run:u=>{const h=[],i=[...new Set(u.schema.tables.map(e=>e.name))].toSorted((e,n)=>e.localeCompare(n)),g=new Map(i.map((e,n)=>[e,n])),l=new Map;for(const e of u.schema.tables)for(const n of e.relations){if(n.kind!=="one"||!g.has(n.table))continue;let t=l.get(e.name);t===void 0&&(t=new Set,l.set(e.name,t)),t.add(n.table)}const a=new Set,r=new Map,d=[],f=new Set;let p=!1;const b=e=>{a.delete(e);const n=r.get(e);if(n!==void 0)for(const t of n)n.delete(t),a.has(t)&&b(t)},k=()=>{const e=[...d];if(e.length<2)return;let n=0;for(let s=1;s<e.length;s+=1)e[s]<e[n]&&(n=s);const t=[...e.slice(n),...e.slice(0,n)],o=t.join("→");if(f.has(o))return;f.add(o);const c=[...t,t[0]].join(" → ");h.push(w(S,{cacheKey:`circular_fk:${o}`,detail:`Circular foreign-key dependency detected: ${c}. This cycle can cause unexpected behavior during DELETE operations.`,metadata:{cycle:t,path:c,tables:t}})),f.size>=E&&(p=!0)},y=(e,n)=>[...l.get(e)??[]].filter(t=>g.get(t)>=n),C=(e,n)=>{for(const t of y(e,n)){let o=r.get(t);o===void 0&&(o=new Set,r.set(t,o)),o.add(e)}},m=(e,n,t)=>{let o=!1;d.push(e),a.add(e);for(const c of y(e,t)){if(p)break;c===n?(k(),o=!0):!a.has(c)&&m(c,n,t)&&(o=!0)}return o?b(e):C(e,t),d.pop(),o};for(let e=0;e<i.length&&!p;e+=1)a.clear(),r.clear(),m(i[e],i[e],e);return h},source:"static",title:"Circular foreign-key dependency"};export{S as default};

package/dist/packem_shared/classifySensitivity-JnjaTGYi.mjs

@@ -0,0 +1 @@
+const i=[{fact:e=>e.writesUserTable,reason:"writes an identity table"},{fact:e=>e.callsMail,reason:"sends mail"},{fact:e=>e.fanOut,reason:"fans out to a privileged dispatch surface"},{fact:e=>e.usesInsertManyUnsafe,reason:"bypasses validators with insertManyUnsafe"},{fact:e=>e.unboundedAiGeneration,reason:"runs an unbounded AI generation"}],o="may exhibit sensitive behaviour — its handler body could not be read",l=e=>{const a=[];let s=!1;for(const n of i){const t=n.fact(e);t===!0?a.push(n.reason):t===void 0&&(s=!0)}return s&&a.push(o),{level:a.length===0?"none":"high",reasons:a}};export{l as default};

package/dist/packem_shared/commitOrderedHardDelete-BPdwOKA7.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";const n={categories:["SCHEMA"],description:"A `.commitOrdered()` table without `.softDelete()` cannot express a delete in its `_commitSeq` feed: the sequence lives on the row, so a hard-deleted row vanishes with no event a consumer can observe.",facing:"INTERNAL",level:"WARN",name:"commit_ordered_hard_delete",remediation:"Add `.softDelete()` so the tombstone flip advances `_commitSeq` and pages through the feed — or, if the table is genuinely append-only and nothing is ever deleted from it, leave it as-is.",run:o=>{const t=[];for(const e of o.schema.tables)e.commitOrdered!==!0||e.softDelete!==void 0||t.push(a(n,{cacheKey:`commit_ordered_hard_delete:${e.name}`,detail:`Table "${e.name}" is \`.commitOrdered()\` but not \`.softDelete()\`. A hard delete removes the row and its \`_commitSeq\` together, so a changefeed paging on the sequence never learns the row is gone.`,metadata:{table:e.name}}));return t},source:"static",title:"Commit-ordered table cannot express deletes"};export{n as default};

package/dist/packem_shared/compareToBaseline-CUG59IOy.mjs

@@ -0,0 +1 @@
+import{byCodepoint as f}from"./MAP_VERSION-MQ5W2B6n.mjs";const m=new Set(["clean","exempt","failing","warned"]),u=(e,r)=>{const c=new Map(e.map(s=>[s.name,s.occurrences]));return r.some(s=>s.occurrences>(c.get(s.name)??0))},n=e=>typeof e=="number"&&Number.isFinite(e),g=e=>Array.isArray(e)&&e.every(r=>{if(typeof r!="object"||r===null)return!1;const c=r;return typeof c.name=="string"&&n(c.occurrences)}),h=e=>{if(typeof e!="object"||e===null)return!1;const r=e;return typeof r.id=="string"&&n(r.score)&&typeof r.coverage=="string"&&m.has(r.coverage)&&g(r.checks)},y=e=>{if(typeof e!="object"||e===null)return!1;const r=e;return g(r.checks)&&n(r.score)},v=(e,r)=>{if(r.version!==e.version)return{comparable:!1,reason:"version-mismatch"};const c=new Map(r.procedures.map(o=>[o.id,o])),s=[],i=[],p=[];for(const o of e.procedures){if(o.coverage==="exempt")continue;const t=c.get(o.id);t!==void 0&&t.coverage!=="exempt"&&o.score<t.score&&s.push({after:o.score,before:t.score,id:o.id}),o.coverage==="failing"&&t?.coverage!=="failing"&&i.push(o.id),u(t?.checks??[],o.checks)&&p.push(o.id)}s.sort((o,t)=>f(o.id,t.id)),i.sort(f),p.sort(f);const a=e.score-r.score,d=u(r.project.checks,e.project.checks);return{comparable:!0,dropped:s,newFailing:i,projectRegressed:d,regressed:a<0||s.length>0||i.length>0||p.length>0||d,scoreDelta:a,worsened:p}},b=e=>{if(typeof e!="object"||e===null)return;const r=e;if(!(!n(r.version)||!n(r.score))&&!(!Array.isArray(r.procedures)||!r.procedures.every(c=>h(c)))&&y(r.project))return e};export{v as compareToBaseline,b as parseAdvisorMap};

package/dist/packem_shared/containerInstanceKeyFromUserInput-Bl-tAzKV.mjs

@@ -0,0 +1 @@
+import{m as t}from"./argument-derived-sink-DLXFC79t.mjs";import{c as n,a as r}from"./helpers-DdZ_pyR3.mjs";const s=t({cacheKey:e=>`container_instance_key_from_user_input:${e.file}:${e.line.toString()}`,categories:["SECURITY"],description:"A `ctx.containers.<name>.get` call routes to a container instance using a key derived from the handler's `args` with no server-side scoping. Any caller can supply another tenant's key and reach that tenant's container instance — a cross-tenant insecure direct object reference (IDOR).",detail:e=>`\`ctx.containers.*.${e.method}\` in ${r(e)} routes to a container instance using a key derived from \`args\` with no server-side scoping — any caller can reach another tenant's container (IDOR). Derive the key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`).`,facing:"EXTERNAL",getAccesses:e=>e.containerKeyAccesses,level:"WARN",metadata:e=>({...n(e),method:e.method}),name:"container_instance_key_from_user_input",remediation:"Derive the container instance key from a server-trusted identity (e.g. `${ctx.auth.userId}`) or a record the caller owns — never pass request input straight to `ctx.containers.<name>.get`.",title:"Possible cross-tenant IDOR from arg-derived unscoped container key"});export{s as default};

package/dist/packem_shared/containerOversizedInstance-Bx89uR7E.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";const r=new Set(["standard-3","standard-4"]),o=2,c=4096,d=e=>typeof e=="string"?r.has(e):(e.vcpu??0)>o||(e.memoryMib??0)>c,l={categories:["PERFORMANCE"],description:"A container is declared on a large instance type, whose provisioned memory and disk are billed for the lifetime of every running instance.",facing:"INTERNAL",level:"INFO",name:"container_oversized_instance",remediation:"Confirm the workload needs this size; a smaller instanceType (lite/basic/standard-1) costs less while idle-but-running.",run:e=>{const t=[];for(const i of e.containers??[]){const{instanceType:n}=i;if(n===void 0||!d(n))continue;const s=typeof n=="string"?n:JSON.stringify(n);t.push(a(l,{cacheKey:`container_oversized_instance:${i.exportName}`,detail:`Container "${i.exportName}" uses a large instance type (${s}); its memory + disk are billed while any instance runs.`,metadata:{container:i.exportName,instanceType:n}}))}return t},source:"static",title:"Oversized container instance"};export{l as default};

package/dist/packem_shared/containerPublicInternet-BFfZf_P4.mjs

@@ -0,0 +1 @@
+import{e as n}from"./finding-NrKO8idM.mjs";const a={categories:["SECURITY"],description:"A container leaves outbound internet access at the default (enabled), which is billed per GB of egress and widens the attack surface.",facing:"INTERNAL",level:"INFO",name:"container_public_internet",remediation:"Set `enableInternet: false` on the container if it doesn't call external services, or `true` to opt in deliberately.",run:t=>(t.containers??[]).filter(e=>e.enableInternet===void 0).map(e=>n(a,{cacheKey:`container_public_internet:${e.exportName}`,detail:`Container "${e.exportName}" doesn't set enableInternet, so outbound internet is on by default (egress is billed).`,metadata:{container:e.exportName}})),source:"static",title:"Container egress enabled by default"};export{a as default};

package/dist/packem_shared/containerRuntimeEgressRelaxation-4tMrhq1k.mjs

@@ -0,0 +1 @@
+import{callSiteDescription as a}from"./callSiteCallers-DArHfQSU.mjs";import{e as i}from"./finding-NrKO8idM.mjs";import{c as n}from"./helpers-DdZ_pyR3.mjs";const r={categories:["SECURITY"],description:"A runtime `.egress.allow(...)` / `.egress.deny(...)` / `.egress.setAllowed(...)` call mutates the container's egress firewall at runtime, re-opening a network surface the static analysis assumes is locked to the `defineContainer` declaration.",facing:"EXTERNAL",level:"WARN",name:"container_runtime_egress_relaxation",remediation:"Prefer declaring the egress policy statically in `lunora/containers.ts` where it is auditable. When a runtime mutation is unavoidable, scope it behind a server-trusted check and keep the change narrow (a specific host, not a broad allow) rather than an unconditional relaxation.",run:t=>t.containerOverrides===void 0?[]:t.containerOverrides.filter(e=>e.kind==="egress_relaxation").map(e=>i(r,{cacheKey:`container_runtime_egress_relaxation:${e.file}:${e.line.toString()}`,detail:`${a(e.scope)} calls \`.egress.${e.detail}(...)\` at runtime, mutating the container's egress firewall.`,metadata:{...n(e),method:e.detail}})),source:"static",title:"Runtime egress mutation relaxes the container firewall"};export{r as default};

package/dist/packem_shared/containerStartEnableInternetOverride-mN_kuRtk.mjs

@@ -0,0 +1 @@
+import{callSiteDescription as n}from"./callSiteCallers-DArHfQSU.mjs";import{e as r}from"./finding-NrKO8idM.mjs";import{c as i}from"./helpers-DdZ_pyR3.mjs";const a={categories:["SECURITY"],description:"A runtime `.start({ enableInternet: true, … })` call overrides the static `defineContainer` declaration and re-opens public internet egress for that container instance, defeating the `container_public_internet` lint's assumption that the declaration is authoritative.",facing:"EXTERNAL",level:"WARN",name:"container_start_enable_internet_override",remediation:"Avoid overriding `enableInternet` at `.start()` time. Set it once on the `defineContainer` declaration in `lunora/containers.ts` so the static advisors can reason about it, and gate any runtime opt-in behind a server-trusted check rather than an unconditional literal.",run:t=>t.containerOverrides===void 0?[]:t.containerOverrides.filter(e=>e.kind==="enable_internet").map(e=>r(a,{cacheKey:`container_start_enable_internet_override:${e.file}:${e.line.toString()}`,detail:`${n(e.scope)} calls \`.start({ enableInternet: true })\`, overriding the container's static egress posture.`,metadata:{...i(e)}})),source:"static",title:"Runtime .start() override re-enables container internet access"};export{a as default};

package/dist/packem_shared/crossModuleTableWrite-DjiVTAwK.mjs

@@ -0,0 +1 @@
+import{callSiteLabel as d,callSiteMetadata as m,callSiteDescription as u}from"./callSiteCallers-DArHfQSU.mjs";import{e as h}from"./finding-NrKO8idM.mjs";const f=(o,l)=>o.find(n=>n.ownsFolder!==!1&&l.startsWith(`${n.name}/`))?.name,p={categories:["SCHEMA"],description:"A function writes to a table that a different module declares it owns (`defineModule({ tables })`), or to an installed component's table from outside the component. The write couples the two modules: the owner can no longer change the table's shape or invariants without breaking a caller it does not know about.",facing:"INTERNAL",level:"WARN",name:"cross_module_table_write",remediation:"Move the write into the owning module and call it from there: an exported helper in the owner's files that takes the caller's `ctx` (`openInvoice(ctx, …)`) keeps the write in the caller's invocation, and a registered owner mutation runs through `ctx.runMutation(internal.<owner>.<fn>, …)`. Or move the table's ownership to the module that writes it. For a component's table, call the function the component exports for that write.",run:o=>{const l=o.modules??[],n=new Map(l.flatMap(e=>e.tables.map(t=>[t,e]))),i=[...o.inserts??[],...o.tableWrites??[]];if(n.size===0||i.length===0)return[];const r=new Set;return i.flatMap(e=>{const t=n.get(e.table),a=f(l,e.file),s=`cross_module_table_write:${e.file}:${d(e.scope)}:${e.table}`;if(t===void 0||t.name===a||r.has(s))return[];r.add(s);const c=t.installed===!0?`the installed component \`${t.name}\``:`module \`${t.name}\``;return[h(p,{cacheKey:s,detail:`${u(e.scope)} (${e.file}) writes to \`${e.table}\`, which ${c} owns, from ${a===void 0?"outside every module":`module \`${a}\``}.`,metadata:{...m(e.scope),file:e.file,owner:t.name,table:e.table,...t.installed===!0?{installed:!0}:{},...a===void 0?{}:{writer:a}}})]})},source:"static",title:"Function writes a table another module owns"};export{p as default};

package/dist/packem_shared/dedupeCacheKeys-DtBOHffV.mjs

@@ -0,0 +1 @@
+const a=r=>{const t=new Map;return r.map(e=>{const c=(t.get(e.cacheKey)??0)+1;return t.set(e.cacheKey,c),c===1?e:{...e,cacheKey:`${e.cacheKey}:${c.toString()}`}})};export{a as dedupeCacheKeys};

package/dist/packem_shared/dispatch-namespace-BE_LxN7Z.mjs

@@ -0,0 +1 @@
+const a=/\/index$/u,n=/[^\dA-Za-z]/gu,c=e=>e.replace(a,"").split("/").map(s=>s.replaceAll(n,"_")),t=e=>c(e).join("_");export{t as s};

package/dist/packem_shared/dispatchCycle-CWc5Q0cd.mjs

@@ -0,0 +1 @@
+import{s as f}from"./dispatch-namespace-BE_LxN7Z.mjs";import{e as h}from"./finding-NrKO8idM.mjs";const p=i=>{const c=[];for(const t of i)(t.kind==="call"||t.kind==="schedule")&&t.target!==void 0&&t.conditional!==!0&&t.scope.kind==="export"&&c.push({file:t.file,from:`${f(t.file)}:${t.scope.name}`,kind:t.kind,line:t.line,to:t.target});return c},m=(i,c)=>{const t=new Map,n=new Set,s=[],a=[],d=e=>{const o={index:t.size,lowLink:t.size};t.set(e,o),s.push(e),n.add(e);for(const l of c.get(e)??[]){const r=t.get(l);r===void 0?o.lowLink=Math.min(o.lowLink,d(l).lowLink):n.has(l)&&(o.lowLink=Math.min(o.lowLink,r.index))}if(o.lowLink===o.index){const l=[];for(let r=s.pop();r!==void 0;r=r===e?void 0:s.pop())n.delete(r),l.push(r);a.push(l)}return o};for(const e of i)t.has(e)||d(e);return a},u=i=>`\`${i.from}\` ${i.kind==="schedule"?"schedules":"calls"} \`${i.to}\` (${i.file}:${i.line.toString()})`,k={categories:["PERFORMANCE"],description:"Functions dispatch each other (or themselves) in a cycle where every hop is unconditional — no guard, loop, `try`, or early return in front of any of them. Once one of them runs, the chain re-schedules itself forever, and every storage read or write along it is billed on every pass.",facing:"EXTERNAL",level:"ERROR",name:"dispatch_cycle",remediation:"Put a stop condition in front of the re-dispatch: reschedule only while there is work left (`if (remaining > 0) await ctx.scheduler.runAfter(…)`), carry an attempt counter in the args and stop at a cap, keep the returned id so a stop path can `ctx.scheduler.cancel` it, or move periodic work to a `cron`. If the chain already stops by throwing from a helper, make that stop condition explicit at the call site.",run:i=>{if(i.callEdges===void 0)return[];const c=p(i.callEdges),t=new Map;for(const n of c){const s=t.get(n.from);s===void 0?t.set(n.from,[n.to]):s.push(n.to)}return m([...t.keys()].toSorted((n,s)=>n.localeCompare(s)),t).flatMap(n=>{const s=new Set(n),a=c.filter(e=>s.has(e.from)&&s.has(e.to)).toSorted((e,o)=>e.from.localeCompare(o.from)||e.file.localeCompare(o.file)||e.line-o.line);if(a.length===0)return[];const d=n.toSorted((e,o)=>e.localeCompare(o));return[h(k,{cacheKey:`dispatch_cycle:${d.join(",")}`,detail:`Unconditional dispatch cycle: ${a.map(e=>u(e)).join("; ")}. No guard stands in front of any hop, so once one of these functions runs the chain never stops.`,metadata:{functions:d,hops:a.map(e=>({file:e.file,from:e.from,kind:e.kind,line:e.line,to:e.to}))}})]})},source:"static",title:"Endless dispatch cycle"};export{k as default};

package/dist/packem_shared/duplicateIndex-Cip6-Rpu.mjs

@@ -0,0 +1 @@
+import{e as r}from"./finding-NrKO8idM.mjs";const o=(a,i)=>a.length>i.length?!1:a.every((n,d)=>n===i[d]),l={categories:["PERFORMANCE"],description:"A secondary index is redundant because another index already covers every lookup it serves (its columns are a leading prefix of the other's). The redundant index costs storage and is maintained on every write for no read benefit.",facing:"INTERNAL",level:"INFO",name:"duplicate_index",remediation:"Drop the redundant index; the covering index already serves its lookups.",run:a=>{const i=[];for(const n of a.schema.tables){const d=n.indexes.filter(e=>e.kind==="index");for(const e of d){if(e.unique===!0)continue;const t=d.find(s=>s===e||!o(e.fields,s.fields)?!1:e.fields.length===s.fields.length?e.name>s.name:!0);t&&i.push(r(l,{cacheKey:`duplicate_index:${n.name}:${e.name}`,detail:`Index "${e.name}" on table "${n.name}" (${e.fields.join(", ")}) is redundant — index "${t.name}" (${t.fields.join(", ")}) already covers its lookups.`,metadata:{coveredBy:{fields:t.fields,name:t.name},fields:e.fields,index:e.name,table:n.name}}))}}return i},source:"static",title:"Duplicate / redundant index"};export{l as default};

package/dist/packem_shared/emptyIndex-BnHDcXza.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";const i={categories:["SCHEMA"],description:"An index declares no columns, so it indexes nothing and can never narrow a read.",facing:"INTERNAL",level:"WARN",name:"empty_index",remediation:"Give the index its columns, or remove it.",run:a=>a.schema.tables.flatMap(n=>n.indexes.filter(e=>e.kind==="index"&&e.fields.length===0).map(e=>t(i,{cacheKey:`empty_index:${n.name}:${e.name}`,detail:`Index "${e.name}" on table "${n.name}" declares no columns.`,metadata:{index:e.name,table:n.name}}))),source:"static",title:"Empty index"};export{i as default};

package/dist/packem_shared/errorWithoutCatalog-BTfvaXHR.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";const o={categories:["SCHEMA"],description:"A procedure throws a bare `new Error(...)`. It reaches the client as an opaque message the caller cannot branch on, and error grouping cannot fingerprint it into a stable issue.",facing:"EXTERNAL",level:"WARN",name:"error_without_catalog",remediation:'Throw a coded error instead: `throw new LunoraError("<CODE>", { … })` from `@lunora/errors`, adding the code to `ERROR_CATALOG` if it is new.',run:e=>e.procedureProtections===void 0?[]:e.procedureProtections.filter(r=>r.throwsBareError===!0).map(r=>t(o,{cacheKey:`error_without_catalog:${r.file}:${r.exportName}`,detail:`${r.kind} \`${r.exportName}\` (${r.file}) throws a bare \`new Error(...)\`. Use \`LunoraError\` with a catalog code so the client can branch on it and Studio can group it.`,metadata:{exportName:r.exportName,file:r.file,kind:r.kind}})),source:"static",title:"Bare Error thrown instead of a coded LunoraError"};export{o as default};

package/dist/packem_shared/exportSinkMisconfigured-JfbAx9AI.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";const c={defineExportSink:["name","deliver"],r2Sink:["bucket","name"],webhookExportSink:["name","url"]},f={categories:["SCHEMA"],description:"A CDC export sink (`defineExportSink` / `webhookExportSink` / `r2Sink`) is missing a required config field (a webhook with no `url`, an R2 sink with no `bucket`, or a sink with no `name`/`deliver`). The sink can never deliver a change batch, so the export tap silently drains nothing.",facing:"INTERNAL",level:"ERROR",name:"export_sink_misconfigured",remediation:"Supply the missing field: a non-empty `url` for `webhookExportSink`, a `bucket` R2 binding for `r2Sink`, or `name` + `deliver` for `defineExportSink`.",run:n=>{if(n.exportSinks===void 0)return[];const t=[];for(const e of n.exportSinks){if(!e.analyzable)continue;const r=new Set(e.presentKeys),o=new Set(e.emptyKeys);for(const i of c[e.factory]??[]){if(r.has(i)&&!o.has(i))continue;const s=o.has(i)?"is set to an empty string":"is missing";t.push(a(f,{cacheKey:`export_sink_misconfigured:${e.file}:${e.line.toString()}:${i}`,detail:`\`${e.factory}({ … })\` in ${e.file}:${e.line.toString()} ${s} its required \`${i}\` field — the sink can never deliver a change batch, so the export tap drains nothing.`,metadata:{factory:e.factory,field:i,file:e.file,line:e.line}}))}}return t},source:"static",title:"Export sink is misconfigured"};export{f as default};

package/dist/packem_shared/externalSourceIncrementalNoDeletePath-BCzm3HzF.mjs

@@ -0,0 +1 @@
+import{e as n}from"./finding-NrKO8idM.mjs";const l={categories:["SCHEMA"],description:"A `.source({ mode: 'incremental' })` table declares no delete-visibility path (`reconcileEveryMs` or `softDeleteColumn`), so upstream deletes are never applied and the materialized table accumulates phantom rows.",facing:"EXTERNAL",level:"ERROR",name:"external_source_incremental_no_delete_path",remediation:"Add `reconcileEveryMs` (a periodic full-pull sweep that GCs vanished rows) or `softDeleteColumn` (an upstream tombstone column the incremental pull returns). Incremental ingest can't see a delete otherwise.",run:o=>{const a=[];for(const e of o.schema.tables){const t=e.externalSource;if(t!==void 0){if(t.unanalyzable){a.push(n(l,{cacheKey:`external_source_incremental_no_delete_path:${e.name}`,detail:`Table \`${e.name}\`'s \`.source(...)\` config is not a static object literal, so its \`mode\`/delete-visibility can't be verified. If it is \`mode: "incremental"\`, confirm it declares \`reconcileEveryMs\` or \`softDeleteColumn\` — an incremental source without one accumulates phantom rows on every upstream delete.`,level:"WARN",metadata:{table:e.name}}));continue}t.mode!=="incremental"||t.hasReconcile||t.hasSoftDelete||a.push(n(l,{cacheKey:`external_source_incremental_no_delete_path:${e.name}`,detail:`Table \`${e.name}\` is \`.source({ mode: "incremental" })\` but declares neither \`reconcileEveryMs\` nor \`softDeleteColumn\` — an incremental pull never sees upstream deletes, so the materialized table would accumulate phantom rows. Add one of the two delete-visibility paths.`,metadata:{table:e.name}}))}}return a},source:"static",title:"Incremental sourced table has no delete-visibility path"};export{l as default};

package/dist/packem_shared/externalSourceOnGlobal-CH7xbJ49.mjs

@@ -0,0 +1 @@
+import{e as t}from"./finding-NrKO8idM.mjs";const l={categories:["SCHEMA"],description:"A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",facing:"INTERNAL",level:"ERROR",name:"external_source_on_global",remediation:'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',run:a=>a.schema.tables.filter(e=>e.externalSource!==void 0&&e.shardKind==="global").map(e=>t(l,{cacheKey:`external_source_on_global:${e.name}`,detail:`Table \`${e.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,metadata:{table:e.name}})),source:"static",title:"Sourced table cannot also be global"};export{l as default};

package/dist/packem_shared/externalSourceUnscoped-BxU2uSXk.mjs

@@ -0,0 +1 @@
+import{e as a}from"./finding-NrKO8idM.mjs";const n={categories:["SECURITY"],description:"A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",facing:"EXTERNAL",level:"ERROR",name:"external_source_unscoped",remediation:"Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",run:s=>{const t=[];for(const e of s.schema.tables)if(!(e.externalSource===void 0||e.shardKind!=="shardBy")){if(e.externalSource.unanalyzable){t.push(a(n,{cacheKey:`external_source_unscoped:${e.name}`,detail:`Table \`${e.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,level:"WARN",metadata:{table:e.name}}));continue}e.externalSource.hasTenantBy||t.push(a(n,{cacheKey:`external_source_unscoped:${e.name}`,detail:`Table \`${e.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,metadata:{table:e.name}}))}return t},source:"static",title:"Sourced + sharded table is not tenant-scoped"};export{n as default};

package/dist/packem_shared/fanOutBreadth-CBtmZnoh.mjs

@@ -0,0 +1 @@
+import{e as i}from"./finding-NrKO8idM.mjs";const n=1e3,o=500,d={categories:["PERFORMANCE"],description:"A shard set is wide enough that a cross-shard read over it would approach the per-invocation subrequest ceiling.",facing:"EXTERNAL",level:"WARN",name:"fan_out_breadth",remediation:"Keep reads shard-pinned, or roll cross-shard answers up through a `.global()` table.",run:s=>{const a=(s.shardTraffic??[]).filter(e=>e.requests>0);if(a.length===0)return[];const r=new Map;for(const e of a){const t=e.group??"";r.set(t,(r.get(t)??0)+1)}return[...r].filter(([,e])=>e>=o).map(([e,t])=>i(d,{cacheKey:`fan_out_breadth:${e}`,detail:`${e===""?"This deployment":`Shard group "${e}"`} has ${String(t)} active shards, so a cross-shard read over it would issue ${String(t)} Durable Object subrequests — against a ceiling of ${String(n)} per invocation on the Free plan (higher on Paid, but finite). Shard-pinned reads are unaffected.`,metadata:{freePlanCeiling:n,group:e,shards:t}}))},source:"runtime",title:"Shard set wide enough to strain a cross-shard read"};export{d as default};

package/dist/packem_shared/filterAfterIndexScan-CV8aPq7v.mjs

@@ -0,0 +1 @@
+import{e as o}from"./finding-NrKO8idM.mjs";import{i as l,c,q as f}from"./helpers-DdZ_pyR3.mjs";import{o as h,u as x}from"./sweeps-JWMwcakB.mjs";const m={categories:["PERFORMANCE"],description:"A query calls `.withIndex(…)` and then `.filter(…)` on a field that index does not cover. The index narrows the scan, and the filter discards most of the rows it read. Extending the index with the field lets the read seek instead of scanning.",facing:"EXTERNAL",level:"INFO",name:"filter_after_index_scan",remediation:"Add the filtered field to the index the read uses, so the range covers it, or confirm the predicate cannot be expressed as an index range and keep the filter.",run:t=>{const n=[],r=l(t.schema),d=new Set(h(t));for(const e of t.queries??[]){if(!e.hasFilter||e.table===""||e.index?.name===void 0||e.filterFields===void 0||d.has(e))continue;const a=r(e);if(a===void 0)continue;const i=x(e,a);i.length!==0&&n.push(o(m,{cacheKey:`filter_after_index_scan:${e.file}:${e.line.toString()}:${e.table}`,detail:`Query on "${e.table}" at ${f(e)} narrows with index "${e.index.name}" and then filters on ${i.map(s=>`"${s}"`).join(", ")}, which the index does not cover. The filter reads every row the index range returns and keeps only those that match.`,metadata:{...c(e),filteredFields:i,indexName:e.index.name,table:e.table}}))}return n},source:"static",title:"Filter after index scan"};export{m as default};

package/dist/packem_shared/filterOnPrimaryKey-BeHVg4w3.mjs

@@ -0,0 +1 @@
+import{e as r}from"./finding-NrKO8idM.mjs";import{q as a,c as s}from"./helpers-DdZ_pyR3.mjs";const l={categories:["PERFORMANCE"],description:"A query filters on `_id`, the primary key. That walks the table comparing every row's id, when `ctx.db.get(id)` fetches the row directly. There is no case where the scan is preferable.",facing:"EXTERNAL",level:"WARN",name:"filter_on_primary_key",remediation:'Replace `ctx.db.query("table").filter((d) => d._id === id).first()` with `ctx.db.get(id)`. Passing a typed `Id<"table">` also narrows the result to that table\'s `Doc`, where the scan form returns the shared row type.',run:t=>(t.queries??[]).filter(e=>e.filtersPrimaryKey===!0&&e.table!=="").map(e=>{const i=a(e);return r(l,{cacheKey:`filter_on_primary_key:${e.file}:${e.line.toString()}:${e.table}`,detail:`Query on "${e.table}" at ${i} filters on \`_id\` — it scans "${e.table}" to find a row \`ctx.db.get(id)\` addresses directly.`,metadata:{...s(e),table:e.table}})}),source:"static",title:"Filter on primary key instead of ctx.db.get"};export{l as default};

package/dist/packem_shared/filterWithoutIndex-BGv3jbgg.mjs

@@ -0,0 +1 @@
+import{e as s}from"./finding-NrKO8idM.mjs";import{s as c,q as u,c as f}from"./helpers-DdZ_pyR3.mjs";const l={categories:["PERFORMANCE"],description:"A query calls `.filter()` without a `.withIndex()` / `.withSearchIndex()`, so it loads every row in the table and filters in memory — a full table scan that gets linearly slower as the table grows.",facing:"EXTERNAL",level:"WARN",name:"filter_without_index",remediation:'Narrow the read with `.withIndex("name", (q) => q.eq(...))` first, then `.filter()` only for what the index cannot express.',run:i=>{const t=[],d=c(i.schema);for(const e of i.queries??[]){if(!e.hasFilter||e.hasIndex||e.table===""||e.filtersPrimaryKey===!0)continue;const n=u(e),a=d.get(e.table),o={...f(e),shardKind:a??"unknown",table:e.table},r=`filter_without_index:${e.file}:${e.line.toString()}:${e.table}`;if(a==="shardBy"){t.push(s(l,{cacheKey:r,detail:`Query on "${e.table}" at ${n} calls .filter() without an index. "${e.table}" is \`.shardBy()\`, so the read is already scoped to one shard rather than the whole table — this is bounded by one tenant's row count, not the dataset. Add an index if that per-shard count grows large.`,level:"INFO",metadata:o}));continue}const h=new Map([["global",`it scans the whole D1 table "${e.table}" — unbounded, and the cost is a cross-region round trip`],["root",`it loads every row of "${e.table}" from the root Durable Object's SQLite and filters in memory`]]).get(a??"")??`it loads every row of "${e.table}" and filters in memory`;t.push(s(l,{cacheKey:r,detail:`Query on "${e.table}" at ${n} calls .filter() without an index — ${h}.`,metadata:o}))}return t},source:"static",title:"Filter without index"};export{l as default};

package/dist/packem_shared/finding-NrKO8idM.mjs

@@ -0,0 +1 @@
+const t=(e,a)=>({cacheKey:a.cacheKey,categories:a.categories??e.categories,description:e.description,detail:a.detail,facing:a.facing??e.facing,level:a.level??e.level,metadata:a.metadata,name:e.name,remediation:e.remediation,title:e.title});export{t as e};

package/dist/packem_shared/fk-index-DXYS17cc.mjs

@@ -0,0 +1 @@
+const n="_id",t=s=>`by${s.charAt(0).toUpperCase()}${s.slice(1)}`,d=s=>new Set(s.indexes.filter(e=>e.kind==="index").map(e=>e.fields[0]).filter(e=>e!==void 0));export{n as P,d as l,t as s};

package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-B5FBDF8c.mjs

@@ -0,0 +1 @@
+import{e as n}from"./finding-NrKO8idM.mjs";import{c as r,a as o}from"./helpers-DdZ_pyR3.mjs";const f=new Set(["disallow","disallowed","enforce","enforced","enforcement","enforcing","gate","gated","gating","lockdown","rls"]),d=new Set(["allow","allowed","bypass","bypassed","permit","permitted"]),i=new Set(["disable","disabled","no","off","skip","skipped","without"]),u=/(?<=[A-Z])(?=[A-Z][a-z])/gu,c=/(?<=[a-z0-9])(?=[A-Z])/gu,g=/[^a-z0-9]+/u,h=a=>a.replaceAll(u," ").replaceAll(c," ").toLowerCase().split(g).filter(e=>e.length>0),p=a=>{let e=0;for(;e<a.length&&i.has(a[e]);)e+=1;if(e===a.length)return e;let t=0;for(;t<a.length-e&&i.has(a[a.length-1-t]);)t+=1;return e+t},y=a=>{const e=h(a),t=e.some(s=>f.has(s)),l=e.some(s=>d.has(s));if(t!==l)return{protects:t,safeDefault:p(e)%2===1?!t:t}},m={categories:["SECURITY"],description:"A `ctx.flags.boolean(key, default)` read on a security-shaped key has a fail-open default that selects the permissive branch. OpenFeature returns the default when the provider errors, so an outage silently disables a protection (a `false` default on an `enforce`/`rls`/`gate`/`lockdown` key) or grants a permission (a `true` default on an `allow`/`permit`/`bypass` key). A negating token in the key (`disableRls`, `rlsDisabled`, `skipEnforcement`) inverts which default is the safe one.",facing:"EXTERNAL",level:"WARN",name:"flag_gates_security_with_unsafe_default",remediation:"Flip the default so a provider outage fails closed — the finding's own detail names the value to write. The safe default is always the RESTRICTIVE branch, which is not a fixed value: a protection flag (`enforce*`/`rls*`/`gate*`/`lockdown*`/`disallow*`) defaults `true` and a permission/bypass flag (`allow*`/`permit*`/`bypass*`) defaults `false`, but a negated key (`disableRls`, `rlsDisabled`, `skipEnforcement`) inverts both. Never let an unreachable flag backend open access.",run:a=>a.flagSecurityDefaults===void 0?[]:a.flagSecurityDefaults.flatMap(e=>{const t=y(e.key);if(t===void 0||t.safeDefault===e.defaultValue)return[];const l=t.protects?"disabling the guarded protection":"granting the guarded permission";return[n(m,{cacheKey:`flag_gates_security_with_unsafe_default:${e.file}:${e.line.toString()}`,detail:`\`ctx.flags.boolean("${e.key}", ${String(e.defaultValue)})\` in ${o(e)} fails open to the permissive branch — a provider outage returns \`${String(e.defaultValue)}\`, ${l}. Fail closed: default it to \`${String(t.safeDefault)}\`.`,metadata:{defaultValue:e.defaultValue,...r(e),key:e.key}})]}),source:"static",title:"Security flag fails open to the permissive branch"};export{m as default};

package/dist/packem_shared/flagReadInSubscription-DabIhYGD.mjs

@@ -0,0 +1 @@
+import{e as l}from"./finding-NrKO8idM.mjs";const c={categories:["SCHEMA"],description:"A `query` handler reads a feature flag via `ctx.flags`. Flag changes are invisible to the change feed — flipping a flag appends nothing to `__cdc_log` — so no live subscription re-runs and the query keeps serving the branch it picked when it last ran. The staleness produces no error and no reconnect, so it surfaces nowhere at runtime.",facing:"EXTERNAL",level:"WARN",name:"flag_read_in_subscription",remediation:"A flag read inside a query is evaluated once per query run and will NOT update when the flag flips — subscribers keep the old branch until something else invalidates the query. For a flag whose value must reach a live client, subscribe to it directly with `useFlag(...)`, which is served on the reactive flag path and re-evaluated on every write-flush, and branch in the component. If the query genuinely wants a point-in-time evaluation (a gate read once at call time), the read is correct as written and the finding can be dismissed.",run:n=>{if(n.flagReads===void 0)return[];const t=[],r=new Map;for(const e of n.flagReads){const a=`${e.file}:${e.line.toString()}:${e.callee}`,i=(r.get(a)??0)+1;r.set(a,i);const s=i>1?`:${i.toString()}`:"";t.push(l(c,{cacheKey:`flag_read_in_subscription:${a}${s}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) reads a feature flag inside a query handler. The read is evaluated once per query run: flipping the flag appends nothing to the change feed, so no live subscription re-runs and subscribers keep the branch this query last picked. Subscribe with \`useFlag\` on the client if the value must stay live.`,metadata:{callee:e.callee,exportName:e.exportName,file:e.file,line:e.line}}))}return t},source:"static",title:"Feature-flag read inside a live query"};export{c as default};

package/dist/packem_shared/fromServerSchema-KWJd4PLE.mjs

@@ -0,0 +1 @@
+const a=i=>({rlsMode:i.rlsMode,tables:Object.entries(i.tables).map(([s,n])=>{const o=[...n.indexes.map(e=>({fields:e.fields,kind:"index",name:e.name,unique:e.unique})),...n.searchIndexes.map(e=>({fields:[e.field,...e.filterFields??[]],kind:"search",name:e.name})),...n.rankIndexes.map(e=>({fields:[...e.sortBy.map(r=>r.field),...e.partitionBy??[]],kind:"rank",name:e.name})),...n.vectorIndexes.map(e=>({fields:[e.field],kind:"vector",name:e.name})),...n.geoIndexes.map(e=>({fields:[e.field],kind:"geo",name:e.name}))],d={};for(const[e,r]of Object.entries(n.shape))if(r.kind==="optional"){const t=r._meta?.inner;d[e]=t?.kind??r.kind}else d[e]=r.kind;return{externallyManaged:n.isExternallyManaged??!1,externalSource:n.externalSource?{hasReconcile:n.externalSource.reconcileEveryMs!==void 0,hasSoftDelete:n.externalSource.softDeleteColumn!==void 0,hasTenantBy:n.externalSource.tenantBy!==void 0,mode:n.externalSource.mode}:void 0,columnKinds:d,commitOrdered:n.commitOrderedMode,fields:Object.keys(n.shape),indexes:o,isPublic:n.isPublic??!1,name:s,shardKind:n.shardMode.kind,softDelete:n.softDeleteMode,ttl:n.ttlPolicy,relations:Object.entries(n.relationMap).map(([e,r])=>r.through!==void 0?{kind:"many",name:e,table:r.table,through:{...r.through}}:{field:r.field,kind:r.kind,name:e,onDelete:r.onDelete,references:r.references,table:r.table})}})});export{a as fromServerSchema};

package/dist/packem_shared/geoIndexFieldNotGeopoint-BMQuok2-.mjs

@@ -0,0 +1 @@
+import{e as d}from"./finding-NrKO8idM.mjs";import{b as c}from"./helpers-DdZ_pyR3.mjs";const s={categories:["SCHEMA"],description:"A `.geoIndex(name, { field })` points at a column that is not a `v.geoPoint()`, so its geohash companion can't be built and `withGeoIndex(...)` can never match.",facing:"INTERNAL",level:"ERROR",name:"geo_index_field_not_geopoint",remediation:"Point the geo index at a `v.geoPoint()` column, or change the column's type to `v.geoPoint()`.",run:a=>{const t=[];for(const e of a.schema.tables)for(const n of e.indexes){if(n.kind!=="geo")continue;const o=n.fields[0];if(o===void 0)continue;const i=c(e,o);i===void 0||i==="geoPoint"||t.push(d(s,{cacheKey:`geo_index_field_not_geopoint:${e.name}:${n.name}:${o}`,detail:`Geo index "${n.name}" on table "${e.name}" indexes column "${o}", which is a ${i}, not a v.geoPoint().`,metadata:{field:o,index:n.name,kind:i,table:e.name}}))}return t},source:"static",title:"Geo index field is not a geoPoint"};export{s as default};

package/dist/packem_shared/geoIndexUnused-D7C9Qr4U.mjs

@@ -0,0 +1 @@
+import{e as d}from"./finding-NrKO8idM.mjs";const t={categories:["SCHEMA"],description:"A `.geoIndex(name, { field })` is declared but no handler reads it via `withGeoIndex(name, …)`. The geohash companion column is maintained on every write and read by nothing — dead overhead, the geo analogue of a dead index.",facing:"INTERNAL",level:"INFO",name:"geo_index_unused",remediation:'Query the index from a handler with `ctx.db.query("<table>").withGeoIndex("<name>", q => q.near(point, radius))`, or drop the `.geoIndex(...)` declaration so writes stop maintaining its geohash companion.',run:n=>{if(n.geoIndexUsages===void 0)return[];const i=n.geoIndexUsages;if(i.some(e=>e.indexName===""))return[];const o=new Set(i.map(e=>e.indexName));return n.schema.tables.flatMap(e=>e.indexes.filter(a=>a.kind==="geo"&&!o.has(a.name)).map(a=>d(t,{cacheKey:`geo_index_unused:${e.name}:${a.name}`,detail:`No handler reads geo index "${a.name}" on table "${e.name}" via \`withGeoIndex("${a.name}", …)\` — it's declared but never queried, so its geohash companion is maintained on every write for nothing.`,metadata:{index:a.name,table:e.name}})))},source:"static",title:"Geo index is declared but never queried"};export{t as default};

package/dist/packem_shared/globalTableNearColumnLimit-BFbBBd6A.mjs

@@ -0,0 +1 @@
+import{e as n}from"./finding-NrKO8idM.mjs";const l=100,i=2,o=90,s={categories:["SCHEMA"],description:"A `.global()` table is approaching D1's 100-column ceiling, past which it cannot be created.",facing:"INTERNAL",level:"WARN",name:"global_table_near_column_limit",remediation:"Split the table, or move the tail of its fields into one object field.",run:a=>a.schema.tables.filter(e=>e.shardKind==="global"&&e.fields.length+i>=o).map(e=>{const t=e.fields.length+i;return n(s,{cacheKey:`global_table_near_column_limit:${e.name}`,detail:`Global table "${e.name}" needs ${String(t)} columns (${String(e.fields.length)} fields plus id and _creationTime), against D1's limit of ${String(l)}.`,metadata:{columns:t,limit:l,table:e.name}})}),source:"static",title:"Global table near the column limit"};export{s as default};

package/dist/packem_shared/gradeFromScore-KSt58rj1.mjs

@@ -0,0 +1 @@
+const R={ERROR:20,INFO:5,WARN:10},r={ERROR:3,INFO:1,WARN:2},c=t=>Number.isFinite(t)&&t>=0?t:0,I=t=>R[t],s=(t,E)=>r[t]>=r[E]?t:E,_=(t,E="none")=>{const e=t.visibility==="public"?2:.5,n=t.kind==="query"?.5:e;return E==="high"?n*2:n},O=t=>Math.max(1,t*.2),i=t=>{const E=t.reduce((e,n)=>e+c(n.weight),0);return Math.min(100,Math.max(0,100-E))},T=t=>{const E=t.reduce((n,o)=>n+o.weight,0);if(E===0)return 100;const e=t.reduce((n,o)=>n+o.score*o.weight,0);return Math.round(e/E)},L=t=>t>=90?"excellent":t>=70?"good":t>=50?"needs-work":"at-risk",F=t=>t===100?"clean":t>=50?"warned":"failing";export{R as DEFAULT_WEIGHT_BY_LEVEL,F as coverageFromScore,L as gradeFromScore,c as normalizeWeight,_ as procedureWeight,O as projectWeight,T as scoreGlobal,i as scoreProcedure,I as weightFor,s as worstLevel};

package/dist/packem_shared/hardcodedSecret-Bw_4FYrs.mjs

@@ -0,0 +1 @@
+import{dedupeCacheKeys as i}from"./dedupeCacheKeys-DtBOHffV.mjs";import{e as r}from"./finding-NrKO8idM.mjs";const a={categories:["SECURITY"],description:"A secret-shaped string literal (live API key, access key, private key, or high-entropy token) is hard-coded in the source. Committed secrets leak via clone/fork/history and force a redeploy to rotate.",facing:"INTERNAL",level:"ERROR",name:"hardcoded_secret",remediation:'Move the secret out of source: set it locally in `.dev.vars` (`lunora env set <NAME> "<value>"`) and in production with `wrangler secret put <NAME>`, then read it at runtime from `env.<NAME>`. Rotate the exposed value — assume it is already compromised.',run:t=>t.secretLiterals===void 0?[]:i(t.secretLiterals.map(e=>r(a,{cacheKey:`hardcoded_secret:${e.file}:${e.line.toString()}:${e.kind}`,detail:`A ${e.kind.replaceAll("_"," ")} (${e.preview}) is hard-coded at ${e.file}:${e.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,metadata:{file:e.file,kind:e.kind,line:e.line,preview:e.preview}}))),source:"static",title:"Hard-coded secret in source"};export{a as default};

package/dist/packem_shared/helpers-DdZ_pyR3.mjs

@@ -0,0 +1 @@
+import{s as h}from"./dispatch-namespace-BE_LxN7Z.mjs";import{callSiteMetadata as I,helperRole as S,callSiteCallers as d}from"./callSiteCallers-DArHfQSU.mjs";const r=new Set(["delete","deleteMany","hardDelete","patch","patchIf","patchMany","patchWhere","replace"]),$=(e,t)=>e.method!=="patch"&&e.method!=="patchMany"||t===void 0||e.fields===void 0?!0:e.fields.some(n=>t.includes(n)),m=["address","birthdate","creditCard","dateOfBirth","dob","driversLicense","email","firstName","fullName","lastName","nationalId","passport","phone","phoneNumber","socialSecurity","socialSecurityNumber","ssn","taxId"],N=/[^a-z0-9]/giu,_=/([a-z0-9])([A-Z])/gu,w=/[^a-zA-Z0-9]+/u,i=e=>e.replaceAll(N,"").toLowerCase(),c=e=>e.replaceAll(_,"$1_$2").split(w).filter(t=>t.length>0).map(t=>t.toLowerCase()),M=new Set(m.map(e=>i(e))),g=new Set(m.filter(e=>c(e).length===1).map(e=>e.toLowerCase())),A=new Set(["accountId","authorId","createdBy","createdById","organizationId","orgId","ownerId","tenantId","updatedBy","userId","workspaceId"]),E=e=>M.has(i(e))||c(e).some(t=>g.has(t)),L=(e,t)=>{const n=c(e),o=i(e);return t.some(s=>{if(o===i(s))return!0;const a=c(s);return a.length>0&&n.some((l,u)=>a.every((f,p)=>n[u+p]===f))})},O=(e,t)=>e.columnKinds!==void 0&&Object.hasOwn(e.columnKinds,t)?e.columnKinds[t]:void 0,b=new Set(["_creationTime","_id"]),R=e=>e.fields.filter(t=>A.has(t)||E(t)),v=e=>new Set([...b,...e.fields]),P=e=>e.visibility==="public"&&(e.kind==="mutation"||e.kind==="action"),K=e=>e.line>0?`${e.file}:${e.line.toString()}`:e.file,k=e=>{const t=`${e.file}:${e.line.toString()}`;switch(e.scope.kind){case"export":return`\`${e.scope.name}\` (${t})`;case"helper":return`\`${e.scope.name}\` (${t}; ${S(e.scope)})`;default:return`module scope (${t})`}},x=e=>({...I(e.scope),file:e.file,line:e.line}),z=e=>new Map(e.tables.map(t=>[t.name,t.shardKind])),T=(e,t)=>`${h(e)}:${t}`,D=(e,t)=>new Set([...(e??[]).flatMap(n=>n.kind==="schedule"&&n.target!==void 0?[n.target]:[]),...t??[]]),W=(e,t)=>{const n=new Map,o=(s,a)=>{const l=n.get(s);l===void 0?n.set(s,[a]):l.push(a)};for(const s of e??[])if(r.has(s.method))for(const a of d(s.scope))o(`${s.file}:${a}:${s.table}`,{fields:s.fields,method:s.method});for(const s of t??[])r.has(s.method)&&o(`${s.file}:${s.exportName}:${s.table}`,{fields:s.fields,method:s.method});return n},B=e=>{const t=new Map(e.tables.map(n=>[n.name,new Map(n.indexes.filter(o=>o.kind==="index").map(o=>[o.name,o.fields]))]));return n=>{const o=n.index?.name;return o===void 0?void 0:t.get(n.table)?.get(o)}},F=(e,t,n,o=d(t.scope))=>o.some(s=>(e.get(`${t.file}:${s}:${t.table}`)??[]).some(a=>$(a,n)));export{k as a,O as b,x as c,E as d,P as e,T as f,F as g,D as h,B as i,L as m,R as o,K as q,W as r,z as s,v as t};

package/dist/packem_shared/hotShard-BwGYZ3Tq.mjs

@@ -0,0 +1 @@
+import{e as u}from"./finding-NrKO8idM.mjs";const h=.5,d=50,l=r=>{const o=new Map;for(const t of r){const s=t.group??"",e=o.get(s);e===void 0?o.set(s,[t]):e.push(t)}return o},g=(r,o,t)=>{const s=t.reduce((e,n)=>e+n.requests,0);return t.length<2||s<d?[]:t.filter(e=>e.requests/s>=h).map(e=>{const n=e.requests/s,a=e.group!==void 0&&e.group!==""?`"${e.group}" `:"",i=e.shardKey===""?"the root shard":`shard "${e.shardKey}"`,c=Math.round(n*100);return u(r,{cacheKey:`hot_shard:${o}:${e.shardKey}`,detail:`${a}${i} handled ${e.requests.toString()} of ${s.toString()} requests (${c.toString()}%) across ${t.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,metadata:{group:e.group,requests:e.requests,shardCount:t.length,shardKey:e.shardKey,share:n,totalRequests:s}})})},p={categories:["PERFORMANCE"],description:"One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",facing:"EXTERNAL",level:"WARN",name:"hot_shard",remediation:"Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",run:r=>{const o=(r.shardTraffic??[]).filter(t=>t.requests>0);return[...l(o)].flatMap(([t,s])=>g(p,t,s))},source:"runtime",title:"Hot shard"};export{p as default};

package/dist/packem_shared/httpActionMissingAuthGuard-DhMIs1EI.mjs

@@ -0,0 +1 @@
+import{e as i}from"./finding-NrKO8idM.mjs";import{c as n,a as c}from"./helpers-DdZ_pyR3.mjs";const r=(e,t)=>e==="httpRoute"&&t?`\`httpRoute\` ${t} handler`:"`httpAction` handler",h={categories:["SECURITY"],description:"An `httpAction`/`httpRoute` handler performs a side effect (`ctx.runMutation`/`ctx.runAction`/a `ctx.db` write) but never reads `ctx.auth` — an unauthenticated HTTP endpoint driving a state change, bypassing the identity/RLS checks that guard the rest of the app.",facing:"EXTERNAL",level:"WARN",name:"http_action_missing_auth_guard",remediation:"Read `ctx.auth` in the handler before the side effect — call `await ctx.auth.getIdentity()` (or check `ctx.auth.userId`) and reject unauthenticated/unauthorized requests, or forward through a `mutation`/`action` whose RLS policies enforce access. If the endpoint is intentionally public (e.g. a signed webhook), verify the provider signature before the write.",run:e=>e.httpActionGuards===void 0?[]:e.httpActionGuards.filter(t=>!t.readsAuth).map(t=>{const a=r(t.kind,t.method);return i(h,{cacheKey:`http_action_missing_auth_guard:${t.file}:${t.line.toString()}`,detail:`${a} ${c(t)} calls \`ctx.${t.sideEffect}\` but never reads \`ctx.auth\` — an anonymous caller can drive this write. Authenticate the request before the side effect.`,metadata:{...n(t),kind:t.kind,sideEffect:t.sideEffect,...t.method?{method:t.method}:{}}})}),source:"static",title:"Unauthenticated HTTP handler performs a side effect"};export{h as default};